fix(workplans): adopt ADR-007 derived identifiers for unregistered records

These workplans exist only in the retired local hub. Their random pre-ADR-007
identifiers are refused by C-06 as stale references, so they cannot be
registered. Deriving from the canonical record id takes no identity from
anything: central does not hold them and the old ids die with the cache.

Records central already holds were deliberately left untouched.

Refs CUST-WP-0068-T06

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2583210@bnt-lap001
Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006

workplans/RAILIANCE-WP-0022-agent-high-risk-boundary-coverage.md

@@ -14,7 +14,7 @@ related:
   - RISK-F-0009
 origin: routed
 origin_ref: "State Hub message 828e4903-30fe-4903-acfd-cd2ecdda437d"
-state_hub_workstream_id: "b4701216-b235-48d1-a527-b52b8fb7e6fc"
+state_hub_workstream_id: "a7977cbf-ab43-56b7-b7a9-ceb52382b341"
 ---
 
 # RAILIANCE-WP-0022 — Agent high-risk boundary coverage
@@ -40,7 +40,7 @@ establish whether any agent identity actually carries the boundary.
 id: RAILIANCE-WP-0022-T01
 status: done
 priority: high
-state_hub_task_id: "44d1a4bf-70bb-4d50-a40a-2158acc96b36"
+state_hub_task_id: "15cc7f31-4385-500c-9cf9-b356674d8c89"
 ```
 
 Run the capabilities-only ops-warden audit against the policy. The initial
@@ -55,7 +55,7 @@ No credential value was read.
 id: RAILIANCE-WP-0022-T02
 status: done
 priority: high
-state_hub_task_id: "97c73849-716f-45d7-878f-5e1811a594ff"
+state_hub_task_id: "08041e2d-c65e-5977-a4db-82c85ab17d02"
 ```
 
 Add deny-data/read-metadata pairs for the six catalog paths: whynot-design npm,
@@ -74,7 +74,7 @@ catalog entries covered with none uncovered.
 id: RAILIANCE-WP-0022-T03
 status: done
 priority: high
-state_hub_task_id: "9a293b09-dc0c-4575-bdc1-05102fb218a8"
+state_hub_task_id: "021b5c1a-a3fe-510a-93d9-89cd0adb632e"
 ```
 
 Under attended platform authority, upload the reviewed policy, read it back,
@@ -94,7 +94,7 @@ lanes without a concrete address. No Secret value was read.
 id: RAILIANCE-WP-0022-T04
 status: done
 priority: medium
-state_hub_task_id: "64ddfacf-b3f2-428e-9630-4b9f436f627f"
+state_hub_task_id: "96952dd8-0aa7-5498-82a9-b35d47d94694"
 ```
 
 Reply to ops-warden with the deployment evidence and remaining attachment
@@ -116,7 +116,7 @@ repeatable upstream-equality plus policy-coverage command.
 id: RAILIANCE-WP-0022-T05
 status: done
 priority: high
-state_hub_task_id: "47aa5ed9-95c5-4a23-a460-e4bbd3ed6f65"
+state_hub_task_id: "6f034ee3-bbf0-5cbb-bbd2-bb5e9eea6d5d"
 ```
 
 The policy is live but no role attaches it. Do not add the boundary to
@@ -143,8 +143,10 @@ not a blocker to the active AppRole boundary.
 id: RAILIANCE-WP-0022-T06
 status: done
 priority: high
+state_hub_task_id: "3e7bf3f0-10b9-55f8-8393-54158b88542f"
 ```
 
+
 Consume ops-warden's versioned `high-risk-data-paths.yaml` as a policy-check
 input, add the two newly regraded issue-core and reuse-surface paths, and rerun
 source plus live coverage. The input remains ops-warden's risk statement, not