Finish RAILIANCE-WP-0017 consumption-mode enforcement

Read the resource-control open/restricted signal and refuse new orders
that would exceed a restricted entity's published allowance. Open and
missing signals stay unchanged. Safety paths admit with an exception.

workplans/RAILIANCE-WP-0017-consumption-mode-enforcement.md

@@ -4,11 +4,11 @@ type: workplan
 title: "Enforce resource-control consumption mode"
 domain: financials
 repo: railiance-platform
-status: proposed
+status: finished
 owner: codex
 topic_slug: railiance
 created: "2026-08-14"
-updated: "2026-08-14"
+updated: "2026-08-15"
 related:
   - RESOURCE-WP-0005
 origin: residual
@@ -42,7 +42,7 @@ Runbook: `resource-control/docs/resource-procurement-facility.md`.
 
 ```task
 id: RAILIANCE-WP-0017-T01
-status: todo
+status: done
 priority: high
 state_hub_task_id: "1c872918-0872-4b2a-8596-89b106239e54"
 ```
@@ -53,3 +53,14 @@ the current period.
 
 Done when a restricted entity cannot place a new order that would
 exceed the published allowance, and an `open` entity is unchanged.
+
+Delivered 2026-08-15: `scripts/consumption_mode.py`,
+`docs/consumption-mode-enforcement.md`, `make consumption-preflight`.
+Restricted + estimate above allowance exits 2. Open and missing-signal
+admit. Safety/committed paths admit with an exception line. `apps-pg-deploy`
+runs the gate when `CONSUMING_ENTITY` is set.
+
+## Outcome
+
+T01 done. Workplan finished. resource-control still owns the signal;
+this repo only enforces it.