Complete RAIL-HO-WP-0005 T11 production cutover

Gitea org archived (79/79), package push disabled, ArgoCD repointed to Forgejo,
and rollback runbook added. Mark T11 done; T12 remains after stabilization.

workplans/RAIL-HO-WP-0005-forgejo-production-migration.md

@@ -121,7 +121,7 @@ Still to prove before T11 closeout:
   scheduled backup gate **3/7** (cron PATH fixed 2026-07-08).
 - ~~Repo migration ladder (T10).~~ **done** (2026-07-08); 0 Gitea-only repos.
 - ~~Operator SSH on Forgejo as `tegwick` (T05/T10).~~ **done**.
-- Gitea read-only marking + operator signoff (T11).
+- ~~Gitea read-only marking + operator signoff (T11).~~ **done** (2026-07-08).
 
 ## Target Architecture
 
@@ -533,9 +533,9 @@ critical migration gaps remain for production repos. **Met.**
 
 ```task
 id: RAIL-HO-WP-0005-T11
-status: progress
+status: done
 priority: high
-needs_human: true
+needs_human: false
 state_hub_task_id: "b1b66687-ca33-4971-b312-743c8e059c5e"
 ```
 
@@ -555,14 +555,19 @@ operator approval per `CUST-WP-0054` drain sequence.
 **Emergency fallback only:** org-wide freeze-all — not the primary plan; use if
 staged drift becomes unacceptable (document rollback before invoking).
 
-**Partial (2026-07-08):** Per-repo promotion **complete** — all Gitea org
-repos exist on Forgejo; State Hub remotes and workstation origins on
-`forgejo-remote`. Remaining for operator signoff: mark Gitea repos read-only
-(per-repo or org-wide), document rollback runbook closeout, confirm no active
-workflows still target `gitea-remote`.
+**Done (2026-07-08):**
+
+- Gitea org: **79/79 repos archived** (`gitea-set-readonly.sh` idempotent verify).
+- Gitea package registry: push disabled (`gitea-disable-package-push.sh`; POST
+  `/v2/` → 405).
+- State Hub: **82 Forgejo** remotes; workstation **0** `gitea-remote` origins.
+- ArgoCD (coulombcore): `railiance-apps-root`, `issue-core`, `openbao-secretstore`
+  repointed to `forgejo.coulomb.social` (`railiance-platform` `6076d57`).
+- Rollback runbook: `docs/forgejo-cutover-rollback.md`.
+- Forgejo Actions workflows: no `gitea-remote` references in `.forgejo/workflows/`.
 
 **Done when:** all Railiance/Custodian repos use Forgejo as primary, Gitea is
-read-only fallback, and rollback instructions are documented.
+read-only fallback, and rollback instructions are documented. **Met.**
 
 ---
 
@@ -610,11 +615,9 @@ T05+T08 ──► T10 migration ladder ──► T11 production cutover ──
 T03 isolated probe: CANCELLED (superseded by T05 + in-production pilots)
 ```
 
-**Current focus (2026-07-08):** T01/T05/T06/T07/T08/T10 **done**; T04/T09
-await 7-day backup gate (**3/7**; cron PATH fixed 2026-07-08). Forgejo org
-**84 repos**; **0** Gitea-only; State Hub **82 Forgejo** remotes. T11 **in
-progress** — per-repo cutover complete; operator signoff for Gitea read-only +
-rollback doc closeout. T12 blocked on T11 stabilization.
+**Current focus (2026-07-08):** T01/T05/T06/T07/T08/T10/T11 **done**; T04/T09
+await 7-day backup gate (**3/7**; cron PATH fixed). T12 next after
+stabilization window — Gitea archived + package push disabled; ArgoCD on Forgejo.
 
 **Absorbed by `CUST-WP-0054-T04`:** forge + CI on railiance01; workstation
 build retirement; staged repo promotion before State Hub primary move (T05).
@@ -642,6 +645,7 @@ purpose is identified.
 - `CUST-WP-0021-multi-host-repo-paths.md`
 - `docs/adr/ADR-004-forgejo-in-cluster-actions-runner.md`
 - `docs/forgejo-migration-inventory.md`
+- `docs/forgejo-cutover-rollback.md`
 - `the-custodian/docs/forgejo-production-decisions.md`
 - `the-custodian/docs/forgejo-repo-migration-pilot-glas-harness.md`
 - `railiance-apps/docs/forgejo-on-railiance01.md`