Record Core Hub lease and network readiness

workplans/RPF-WP-0021-core-hub-platform-onboarding.md

@@ -234,6 +234,12 @@ OpenBao session receives 403 and CCR-2026-0013 is still proposed; no authority
 or placeholder Secret was improvised. State Hub decision
 `4f70311b-a4c4-4959-b1a1-cdd1be97d523` now carries the non-secret review
 coordinates and awaits the required platform-operator/Core-Hub-owner approval.
+`rapp-postgres` commit `cfde57a` now also owns the Core Hub database-engine
+roles, 30-minute runtime/10-minute migration TTLs, exact two-path ESO policy,
+and non-disclosing renewable-token delivery script. Its 33 tests pass. Live
+configuration still waits for the attended OpenBao authority; concurrent
+tenant-engine workplan edits in that repository were preserved and excluded
+from this commit.
 
 ## T05 — Support the private shadow restore and verification
 
@@ -254,8 +260,10 @@ This task ends with repeatable shadow evidence. It does not flip
 
 Preflight 2026-08-20: the source has Alembic revision `20260627_0002`, eight
 public tables and 39 total rows. The admitted target intentionally has no
-application tables before restore. No dump or restore was attempted ahead of
-the T04 credential gate. Evidence:
+application tables before restore. A ready disposable pod in the labeled
+`core-hub` namespace resolved the `platform-pg` service and reached its
+PostgreSQL port; it was deleted after the check. No dump or restore was
+attempted ahead of the T04 credential gate. Evidence:
 `docs/evidence/core-hub-shadow-preflight-2026-08-20.md`.
 
 ## Acceptance