Record Core Hub lease and network readiness

docs/evidence/core-hub-shadow-preflight-2026-08-20.md

@@ -18,6 +18,13 @@ At `2026-08-20T21:31:13Z` on railiance01:
 - the KV store, database store and three ExternalSecret manifests all passed
   Kubernetes server-side dry-run after namespace creation.
 
+A disposable `postgres:16-alpine` pod was then allowed to become Ready in the
+`core-hub` namespace. DNS resolved
+`platform-pg-rw.databases.svc.cluster.local` to its ClusterIP and `pg_isready`
+reported port 5432 accepting connections. The probe used no database
+credential and was deleted immediately afterward. This verifies the reviewed
+namespace label and `platform-pg` consumer NetworkPolicy path.
+
 ## Source snapshot inventory
 
 A read-only query ran through the existing `coulombcore` SSH route against

workplans/RPF-WP-0021-core-hub-platform-onboarding.md

@@ -234,6 +234,12 @@ OpenBao session receives 403 and CCR-2026-0013 is still proposed; no authority
 or placeholder Secret was improvised. State Hub decision
 `4f70311b-a4c4-4959-b1a1-cdd1be97d523` now carries the non-secret review
 coordinates and awaits the required platform-operator/Core-Hub-owner approval.
+`rapp-postgres` commit `cfde57a` now also owns the Core Hub database-engine
+roles, 30-minute runtime/10-minute migration TTLs, exact two-path ESO policy,
+and non-disclosing renewable-token delivery script. Its 33 tests pass. Live
+configuration still waits for the attended OpenBao authority; concurrent
+tenant-engine workplan edits in that repository were preserved and excluded
+from this commit.
 
 ## T05 — Support the private shadow restore and verification
 
@@ -254,8 +260,10 @@ This task ends with repeatable shadow evidence. It does not flip
 
 Preflight 2026-08-20: the source has Alembic revision `20260627_0002`, eight
 public tables and 39 total rows. The admitted target intentionally has no
-application tables before restore. No dump or restore was attempted ahead of
-the T04 credential gate. Evidence:
+application tables before restore. A ready disposable pod in the labeled
+`core-hub` namespace resolved the `platform-pg` service and reached its
+PostgreSQL port; it was deleted after the check. No dump or restore was
+attempted ahead of the T04 credential gate. Evidence:
 `docs/evidence/core-hub-shadow-preflight-2026-08-20.md`.
 
 ## Acceptance