feat: greenfield rapp wrap path and rail-sequence rules

Add the §0 playbook and kubernetes-then-knative gate to the guide.
Implement rmgr rapp skeleton/wrap/place, draft postgres consumers,
and copy the fleet image workflow when missing.

workplans/RMGR-WP-0007-greenfield-rapp-wrap-efficiency.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Greenfield rapp wrap efficiency"
 domain: infotech
 repo: repo-manager
-status: proposed
+status: finished
 owner: grok
 topic_slug: infotech
 created: "2026-08-18"
@@ -52,7 +52,7 @@ after the user-engine rollout.
 
 ```task
 id: RMGR-WP-0007-T01
-status: todo
+status: done
 priority: high
 state_hub_task_id: "dcf0b76c-05e8-44b4-b31a-33f0bc7273ce"
 ```
@@ -73,11 +73,15 @@ start in the user-engine absorb story.
 
 Do not rewrite the family schemas here.
 
+**Result (2026-08-18):** §0 playbook and §3.1 rail sequence added.
+Inventory lists `rapp-user-engine` as verified. §12 names the live
+commands.
+
 ## Generate a runtime skeleton from the app repo
 
 ```task
 id: RMGR-WP-0007-T02
-status: todo
+status: done
 priority: high
 state_hub_task_id: "2c2c8306-b5b0-467a-a1a5-20c0f979e13d"
 ```
@@ -99,11 +103,15 @@ Refuse Helm unless `--package-type helm-managed-platform-service` or a
 chart already exists. Idempotent: do not overwrite reviewed manifests
 without `--force`.
 
+**Result (2026-08-18):** `rmgr rapp skeleton --from-app` inspects
+Containerfile/deploy, absorbs `deploy/*.yaml` when present, otherwise
+emits a hardened Deployment set.
+
 ## Install the fleet image-publish workflow on the app
 
 ```task
 id: RMGR-WP-0007-T03
-status: todo
+status: done
 priority: high
 state_hub_task_id: "ec2d8fbb-2945-4144-b75e-beddf54a8b87"
 ```
@@ -113,11 +121,14 @@ As part of wrap/skeleton, copy the fleet
 Do not invent registry credentials. Do not build on the workstation.
 Document that the first deploy waits on the CI digest.
 
+**Result (2026-08-18):** `ensure_image_workflow` copies the fleet
+workflow when missing and leaves an existing file alone.
+
 ## Draft the postgres consumer, do not apply it
 
 ```task
 id: RMGR-WP-0007-T04
-status: todo
+status: done
 priority: medium
 state_hub_task_id: "0fe3018a-b245-43b9-a0e2-e0ecb7f6d206"
 ```
@@ -131,11 +142,14 @@ passed.
 This task does not apply the consumer in `rapp-postgres` and does not
 request a CCR.
 
+**Result (2026-08-18):** drafts `handoffs/postgres-consumer.yaml` or
+points at an existing `rapp-postgres/consumers/<app>.yaml`.
+
 ## Compose `rmgr rapp wrap`
 
 ```task
 id: RMGR-WP-0007-T05
-status: todo
+status: done
 priority: high
 state_hub_task_id: "001e7b30-2a86-41f2-b731-415125e3b3e6"
 ```
@@ -148,11 +162,14 @@ exposure grant.
 Refuse unknown rails, `rapp-` workload names, and overwrite of a live
 declaration (same rules as `init`).
 
+**Result (2026-08-18):** `rmgr rapp wrap` composes the steps and reports
+`placed: false`, `applied: false`.
+
 ## Explicit place command
 
 ```task
 id: RMGR-WP-0007-T06
-status: todo
+status: done
 priority: medium
 state_hub_task_id: "076a64c5-cd83-4f7c-ba51-f3c61e5464e8"
 ```
@@ -161,11 +178,14 @@ Add `rmgr rapp place --path <rapp> --reef reef-railiance` that sets
 `bound_reefs` only. Refuse unknown reefs. Do not set
 `exposure.posture: public`.
 
+**Result (2026-08-18):** `rmgr rapp place` sets `bound_reefs` and
+refuses `reef-storage`.
+
 ## Pilot on tenant-engine, files only
 
 ```task
 id: RMGR-WP-0007-T07
-status: todo
+status: done
 priority: high
 state_hub_task_id: "e3845311-b560-4fc2-ad76-5939145350a7"
 ```
@@ -181,6 +201,10 @@ absorbed manifests, `rmgr rapp validate` passes, postgres consumer
 `rapp-secrets-engine` is out of scope (likely not a long-running
 workload). `rapp-vergabe-teilnahme` stays a `railiance-apps` residual.
 
+**Result (2026-08-18):** wrap absorbed `tenant-engine/deploy/`, left the
+live postgres consumer in place, skipped existing `image.yaml`,
+validated `4 declaration(s) ok`. No cluster apply.
+
 ## Residuals
 
 - Applying a drafted postgres consumer and CCR remains with