REUSE-WP-0019-T03: record repo secret addition, close T03

REUSE_SURFACE_TOKEN repo secret added to Forgejo Actions per explicit user
sign-off. Live-verified via manual workflow dispatch: recompose-fallback.yaml
ran to success and the live hub's composed_at advanced to the dispatch
time, confirming the full scheduled-fallback path end to end. T03 fully
complete.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

workplans/REUSE-WP-0019-forgejo-automation-and-telemetry.md

@@ -240,14 +240,20 @@ proven patterns rather than improvising):**
   `reuse-surface:main-09d5b0f` both landed in the Forgejo container
   registry via the packages API
 
-**Blocked, needs separate explicit sign-off (same boundary as the K8s
+**`REUSE_SURFACE_TOKEN` repo secret added 2026-07-07 (explicit user
-Secret write in T02):** adding the `REUSE_SURFACE_TOKEN` repo secret to
+sign-off "Go ahead and add the repo secret"):** fetched the token via
-Forgejo Actions (needed by `recompose-fallback.yaml` to call the
+`warden access reuse-surface-hub-write-token --exec` (never printed) and
-authenticated compose endpoint) was denied by the auto-mode classifier as
+`PUT` it to Forgejo's repo Actions secrets API (`201`). Live-verified by
-a secret-provisioning action distinct from "migrate to Forgejo" — did not
+manually dispatching `recompose-fallback.yaml`
-attempt to work around it. The fallback workflow is deployed and will fail
+(`POST .../actions/workflows/recompose-fallback.yaml/dispatches`) — run
-safely (not silently) until that secret is added; the webhook is the
+completed `success`, and `GET /v1/federated` on the live hub showed
-primary mechanism and is already fully live, so this is a low-priority gap.
+`composed_at` advance to the exact dispatch time, confirming the full
+scheduled-fallback path works end to end, not just that the workflow
+didn't error.
+
+T03 is now fully complete: org webhook live (railiance-apps), this repo's
+CI on Forgejo Actions (all three workflows verified green), and the
+scheduled fallback verified working end to end.
 
 **Not done — moved out of this workplan's scope:** updating
 `docs/deploy/reuse-kubernetes.md`/`railiance-apps` to make
@@ -314,7 +320,7 @@ state_hub_task_id: "a9f44d45-91e2-4b43-909f-30a5f906cf3b"
 ## Acceptance
 
 - [x] No hardcoded forge host in code or sources.yaml; `migrate-host` tested (T01, 2026-07-07)
-- [x] Push to a sibling repo's `registry/indexes/` recomposes the hub index without manual action (webhook), with scheduled fallback in place (T02/T03, 2026-07-07 — webhook live-verified end to end; scheduled fallback deployed, blocked only on a repo secret pending separate sign-off)
+- [x] Push to a sibling repo's `registry/indexes/` recomposes the hub index without manual action (webhook), with scheduled fallback in place (T02/T03, 2026-07-07 — both live-verified end to end)
 - [x] This repo's CI runs on Forgejo Actions (`.forgejo/workflows/`) (T03, 2026-07-07 — `ci.yml`/`ci-smoke.yaml`/`image.yaml` all verified green on the live push)
 - [ ] Reuse events recordable via hub API and CLI; `report reuse` aggregates them
 - [ ] R-axis evidence rules for observed reuse documented in the maturity standard