Implement REIN-A-0002 ops_run claim loop and approach registry.

Add activity-core ops_run client, approach selection (FI/Binky/mail/agent),
claim-loop worker with lease heartbeat, CLI run --from-ops-run and claim-loop,
install units, and docs demoting issue-core to legacy external tickets.
T05 timer cutover remains operator after five clean cycles.

deploy/docs/timer-cutover.md

@@ -0,0 +1,49 @@
+# Timer cutover (REIN-A-0002-T05)
+
+After claim-loop is the proven executor path, demote host oneshot timers to
+**break-glass only**.
+
+## Proof window
+
+Before disabling timers, record **5 clean cycles** (weekday schedule fires or
+forced operator triggers):
+
+| # | Date | Trigger | ops_run id | approach | result |
+| - | ---- | ------- | ---------- | -------- | ------ |
+| 1 |  |  |  |  |  |
+| 2 |  |  |  |  |  |
+| 3 |  |  |  |  |  |
+| 4 |  |  |  |  |  |
+| 5 |  |  |  |  |  |
+
+Each row: `open` → `claimed` → `succeeded` (or `skipped_existing` complete),
+with domain completion event (`fi_daily_brief` / `binky_daily_brief`).
+
+## Demote FI timer
+
+```bash
+systemctl --user disable --now fi-research-brief-daily.timer
+# Keep unit files installed for break-glass:
+# systemctl --user start fi-research-brief-daily.service
+```
+
+## Demote Binky rhythm timer
+
+```bash
+# unit names from binky-control/scripts/railiance-rhythm/systemd/
+systemctl --user disable --now binky-brief-daily.timer 2>/dev/null || true
+systemctl --user list-timers --all | grep -E 'binky|fi-research' || true
+```
+
+## Keep break-glass
+
+- Install scripts remain; document “manual start if claim-loop down”.  
+- Do **not** delete domain rhythm scripts.  
+- activity-core schedule stays authority for *when due*.
+
+## Rollback
+
+```bash
+systemctl --user enable --now fi-research-brief-daily.timer
+# investigate claim-loop journal + actcore /ops-runs
+```