WP-0005: T12 prep checklist, backup gate 4/7, doc refresh

Update workplan with Jul 9 cron success (4/7 gate, ETA Jul 12), add Gitea
retirement dependency scan and operator checklist, and align deploy-stack,
restore-drill evidence, and migration inventory with post-cutover state.

docs/forgejo-restore-drill-evidence.md

@@ -93,20 +93,25 @@ secret, `mailer.ENABLED=false`, Helm `--timeout=20m`.
 
 Exit marker: `restore-drill-complete`
 
-## Gaps (not closed by this drill)
+## Gaps (remaining)
 
-- **Scheduled backups:** CNPG `Backup` CRs and off-cluster target not configured
-  (`kubectl cnpg` plugin absent on workstation).
-- **Encryption at rest:** dump stored locally on workstation for drill only; no
-  approved backup target wired.
-- **Automation:** `railiance-platform` `make forgejo-backup` — daily cron 02:15 UTC;
-  7-day gate still counting.
+- **Scheduled backups:** `railiance-platform` `make forgejo-backup` — daily cron
+  02:15 UTC; 7-day gate **4/7** as of 2026-07-09 (ETA 2026-07-12). CNPG `Backup`
+  CRs deferred (logical `pg_dump` via `forgejo-backup` tool).
 - **Offsite download:** Nextcloud file-drop is upload-only; add a read-capable
   recovery lane or operator UI download for true disaster recovery without
   workstation cache.
 - **Re-run hygiene:** concurrent or repeat runs require `DRILL_CLEAN=1` to wipe
   `forgejo-restore-drill` before import (SQL import is not idempotent).
 
+## Closed since initial drill (2026-07-04)
+
+- **Encryption + offsite target:** age-encrypted artifacts uploaded to Nextcloud
+  `forgejo/` (Option A, T02).
+- **Automation tooling:** `railiance-platform/tools/cmd/forgejo-backup` +
+  `docs/forgejo-backup.md`.
+- **Nextcloud restore drill:** passed 2026-07-08 using artifact `20260707T180844Z`.
+
 ## Cleanup
 
 After evidence capture, delete the drill namespace: