Close RPF-WP-0025, WP-0043 T01/T05, WP-0045 T05; retire bao.coulomb.social defaults

- WP-0025-T03 done: public listener retracted 2026-09-15; bao.coulomb.social
  is retired, tunnel is the operator path; DNS withdrawal handed to S1.
- WP-0043-T01 done: ArgoCD Core reconciles railiance01 at main (evidence).
- WP-0043-T05 done: direct-apply gap inventory and founder proposal.
- WP-0045-T05 cancelled (no rollback needed); T06 preconditions recorded.
- Operator scripts default BAO_ADDR to the openbao-ui-railiance01 tunnel.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 150322@bnt-lap001
Assistant-Session: 16a7b788-374e-4915-a1df-fc87ffd9a5e4

workplans/RPF-WP-0043-policy-nexus-argocd-onboarding.md

@@ -9,7 +9,7 @@ flavor: planning
 owner: railiance-platform
 topic_slug: railiance
 created: "2026-09-21"
-updated: "2026-09-21"
+updated: "2026-09-22"
 due: "2026-12-21"
 related: [RPF-WP-0022]
 state_hub_workstream_id: "ec41a4bd-df18-5b07-9b63-ccb80d9f001c"
@@ -43,7 +43,7 @@ stays untouched and unwrapped while this lane moves.
 
 ```task
 id: RPF-WP-0043-T01
-status: todo
+status: done
 priority: high
 state_hub_task_id: "d6a7a480-6251-504a-aa5f-ab9c04fe1e79"
 ```
@@ -205,7 +205,7 @@ Rollback:
 
 ```task
 id: RPF-WP-0043-T05
-status: todo
+status: done
 priority: medium
 state_hub_task_id: "91431560-79d4-5352-a6b5-f12850315dd2"
 ```
@@ -218,3 +218,16 @@ evidence only. Inventory those targets, declare the gap as not conforming,
 and propose to the founder which ones move to a reconciled lane and which
 stay direct under `APPROVED`. Do not change a target's behaviour as part of
 the inventory.
+
+## Execution record — 2026-09-22
+
+- **T01 done.** Read-only check over `ssh railiance01`. Node 92.205.62.239 is
+  Ready. Argo CD Core runs 1/1 in `argocd`. `railiance-apps-root` is
+  Synced/Healthy at `8a7ebce`, which equals Forgejo `main`. `openbao-secretstore`
+  and `target-revenue` are Synced/Healthy. Evidence:
+  `docs/evidence/2026-09-22-argocd-railiance01-status.json`. This supersedes
+  the custodian's 2026-09-21 "not installed" reading, which predates the phase A
+  install and the kubeconfig fix. The plan continues.
+- **T05 done.** Gap declared and inventoried in
+  `docs/direct-apply-gap-inventory.md`, with a per-group proposal for the
+  founder. No target changed.