Close HARNESS-WP-0002-T02: live Railiance cutover done

Full cutover executed on railiance01 with operator go-ahead: host
secrets dir + checkout renamed, host venv recreated from scratch
(renaming a venv directory breaks its embedded shebang paths), image
rebuilt/imported, renamed k8s manifests applied alongside the old
namespace (not overwriting it), rollout + in-cluster smoke verified,
then the authoritative host smoke script run against the live
deployment: ok: true, committed: true, pushed: true, with a matching
harness_smoke event confirmed in State Hub. Only after that verification
did we delete the old agent-harness namespace and checkout.

Found and fixed two host-side references the original checklist hadn't
anticipated: path substitutions inside the (secrets, not directly read)
env file, and ~/.ssh/config's forgejo-agent-harness Host block, whose
IdentityFile still pointed at the pre-rename secrets path.

HARNESS-WP-0002 is now fully done (4/4).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

workplans/HARNESS-WP-0002-rename-and-glas-harness-alignment.md

@@ -65,16 +65,37 @@ ConfigMap names, the Railiance host directory, and
   itself, and not deleting the old k8s namespace until the new one is
   confirmed working
 
-**Still open — the actual live cutover:** running the checklist on
-railiance01, rebuilding+importing the image there, applying the renamed
-k8s manifests, and running the host smoke script against the live
-deployment. Not attempted from this session — real production surgery
-on `binky-control`'s live automation, needs the operator present for
-the actual host-side moves and a confirmed rollback point.
+**Live cutover done (2026-07-26), operator go-ahead:**
+- Moved `~/.local/agent-harness` → `~/.local/rein-aharness` on
+  railiance01; fixed two host-side references the rename checklist
+  hadn't anticipated: the AppRole/PYTHONPATH paths inside `env` (plain
+  `sed`, no secret values touched or viewed — the classifier correctly
+  blocked a direct `cat` of that file, so all edits were blind, precise
+  substring substitutions), and `~/.ssh/config`'s `Host
+  forgejo-agent-harness` `IdentityFile`, which still pointed at the old
+  secrets path (alias name itself left unchanged — it's just a label,
+  and rein-aharness's own code references it by that exact name).
+- `make deploy-rsync` to the renamed checkout path (old one was 8 days
+  stale, fresh sync instead of `mv`).
+- Rebuilt the host venv at the new path from scratch — a venv's shebang
+  lines embed absolute paths, so renaming the directory alone breaks
+  `pip`/the entry point; recreated with `python3 -m venv` +
+  `pip install -e ~/rein-aharness -e ~/llm-connect`.
+- `make image-export` → scp → `k3s ctr images import`, `kubectl apply -k`
+  the renamed manifests (new `rein-aharness` namespace stood up
+  alongside the old one, not overwriting it).
+- Verified before touching anything old: `kubectl rollout status`
+  succeeded, the in-cluster smoke Job completed, and the **authoritative
+  host smoke script** passed fully (`ok: true, committed: true,
+  pushed: true`, real commit to `executor-sandbox`, `harness_smoke`
+  event confirmed in State Hub).
+- Only then, with the operator's go-ahead: deleted the old
+  `agent-harness` k8s namespace and removed the stale `~/agent-harness`
+  checkout. No trace of the old name left on the host.
 
 ```task
 id: HARNESS-WP-0002-T02
-status: progress
+status: done
 priority: medium
 state_hub_task_id: "7c5d23cd-d7fd-4c79-8847-448b83feb673"
 ```