Implement REIN-A-0002 ops_run claim loop and approach registry.

Add activity-core ops_run client, approach selection (FI/Binky/mail/agent),
claim-loop worker with lease heartbeat, CLI run --from-ops-run and claim-loop,
install units, and docs demoting issue-core to legacy external tickets.
T05 timer cutover remains operator after five clean cycles.

deploy/docs/timer-cutover.md

@@ -0,0 +1,49 @@
+# Timer cutover (REIN-A-0002-T05)
+
+After claim-loop is the proven executor path, demote host oneshot timers to
+**break-glass only**.
+
+## Proof window
+
+Before disabling timers, record **5 clean cycles** (weekday schedule fires or
+forced operator triggers):
+
+| # | Date | Trigger | ops_run id | approach | result |
+| - | ---- | ------- | ---------- | -------- | ------ |
+| 1 |  |  |  |  |  |
+| 2 |  |  |  |  |  |
+| 3 |  |  |  |  |  |
+| 4 |  |  |  |  |  |
+| 5 |  |  |  |  |  |
+
+Each row: `open` → `claimed` → `succeeded` (or `skipped_existing` complete),
+with domain completion event (`fi_daily_brief` / `binky_daily_brief`).
+
+## Demote FI timer
+
+```bash
+systemctl --user disable --now fi-research-brief-daily.timer
+# Keep unit files installed for break-glass:
+# systemctl --user start fi-research-brief-daily.service
+```
+
+## Demote Binky rhythm timer
+
+```bash
+# unit names from binky-control/scripts/railiance-rhythm/systemd/
+systemctl --user disable --now binky-brief-daily.timer 2>/dev/null || true
+systemctl --user list-timers --all | grep -E 'binky|fi-research' || true
+```
+
+## Keep break-glass
+
+- Install scripts remain; document “manual start if claim-loop down”.  
+- Do **not** delete domain rhythm scripts.  
+- activity-core schedule stays authority for *when due*.
+
+## Rollback
+
+```bash
+systemctl --user enable --now fi-research-brief-daily.timer
+# investigate claim-loop journal + actcore /ops-runs
+```

deploy/scripts/install-claim-loop-user.sh

@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+# Install rein-aharness claim-loop as a user systemd service (railiance01).
+# Run from a rein-aharness checkout ON the host:
+#   ./deploy/scripts/install-claim-loop-user.sh
+set -euo pipefail
+ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+UNIT_DIR="${HOME}/.config/systemd/user"
+ENV_DIR="${HOME}/.config/rein-aharness"
+mkdir -p "${UNIT_DIR}" "${ENV_DIR}"
+
+cp -f "${ROOT}/deploy/systemd/rein-aharness-claim-loop.service" "${UNIT_DIR}/"
+
+if [[ ! -f "${ENV_DIR}/claim-loop.env" ]]; then
+  cp "${ROOT}/deploy/systemd/claim-loop.env.example" "${ENV_DIR}/claim-loop.env"
+  chmod 600 "${ENV_DIR}/claim-loop.env"
+  echo "Created ${ENV_DIR}/claim-loop.env — set ACTIVITY_CORE_URL, token, REPO_MAP."
+else
+  echo "Keeping existing ${ENV_DIR}/claim-loop.env"
+fi
+
+# Ensure package entrypoint exists
+if [[ ! -x "${ROOT}/.venv/bin/rein-aharness" ]]; then
+  echo "warning: ${ROOT}/.venv/bin/rein-aharness missing; install with: cd ${ROOT} && uv sync"
+fi
+
+systemctl --user daemon-reload
+systemctl --user enable rein-aharness-claim-loop.service
+echo "Enabled. Start when env is filled:"
+echo "  systemctl --user start rein-aharness-claim-loop.service"
+echo "  journalctl --user -u rein-aharness-claim-loop -f"
+echo "Host timers remain break-glass until T05 cutover (docs/ops-run-claim-loop.md)."

deploy/systemd/claim-loop.env.example

@@ -0,0 +1,14 @@
+# Copy to ~/.config/rein-aharness/claim-loop.env and chmod 600
+
+ACTIVITY_CORE_URL=http://127.0.0.1:8010
+ACTIVITY_CORE_WORKER_TOKEN=
+AGENT_HARNESS_WORKER_ID=rein-aharness@railiance01
+AGENT_HARNESS_OPS_LABELS=automated
+AGENT_HARNESS_OPS_LABELS_MODE=any
+AGENT_HARNESS_OPS_LEASE_SECONDS=900
+AGENT_HARNESS_CLAIM_INTERVAL=30
+AGENT_HARNESS_REPO_MAP={"freedom-intelligence":"/home/tegwick/freedom-intelligence","binky-control":"/home/tegwick/binky-control"}
+AGENT_HARNESS_REPO_ROOTS=/home/tegwick:/home/tegwick/work
+# LLM / hub as required by approaches
+# LLM_CONNECT_URL=http://...
+# STATE_HUB_URL=http://...

deploy/systemd/rein-aharness-claim-loop.service

@@ -0,0 +1,22 @@
+[Unit]
+Description=rein-aharness ops_run claim loop (activity-core automation)
+Documentation=file:%h/rein-aharness/docs/ops-run-claim-loop.md
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+# Adjust paths for the railiance user checkout
+WorkingDirectory=%h/rein-aharness
+EnvironmentFile=-%h/.config/rein-aharness/claim-loop.env
+Environment=PYTHONUNBUFFERED=1
+# Prefer venv entrypoint when installed with uv/pip
+ExecStart=%h/rein-aharness/.venv/bin/rein-aharness claim-loop
+Restart=on-failure
+RestartSec=15
+# Soft stop: claim-loop handles SIGTERM between cycles
+KillSignal=SIGTERM
+TimeoutStopSec=120
+
+[Install]
+WantedBy=default.target