REUSE-WP-0019-T06: hub freshness monitoring, docs, close workplan

reuse_surface/stats.py: _hub_summary() now reports composed_at, stale,
age_days, freshness_threshold_days (REUSE_SURFACE_FRESHNESS_DAYS env,
default 7), and a computed stale_warning. New hub_client.hub_federated()
backs it. format_stats_markdown surfaces a STALE marker when triggered.

.forgejo/workflows/ci.yml: new informational (non-failing) hub freshness
check against the live production hub on every push -- prints a
:⚠️: annotation when stale, never fails the build.

docs/RegistryFederation.md: new section tying together the webhook (T02),
scheduled fallback (T03), and freshness visibility (T06) into one
explanation. docs/deploy/reuse-kubernetes.md: updated for the T03 Forgejo
migration and the now-automated image.yaml build; image promotion
checklist updated for the known /health ingress bug (verify via
/v1/repos or /v1/federated instead).

14 new pytest cases, 173 total pass. Live-verified against production:
reuse-surface stats correctly showed composed_at/age_days for the real
federated index. Separately discovered and confirmed (via a live signed
webhook test) that reuse-surface-env moving to ExternalSecret/OpenBao
custody (railiance-apps commit 706f6c7, found while updating these docs)
did not break the T02/T03 webhook -- the synced value still matches what
the hub actually uses.

REUSE-WP-0019 is now fully complete (T01-T06). SCOPE.md and
docs/IntentScopeGapAnalysis.md updated to reflect closure.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.forgejo/workflows/ci.yml

@@ -54,6 +54,26 @@ jobs:
         working-directory: /tmp/repo
         run: reuse-surface stats || true
 
+      - name: Hub freshness check (informational, REUSE-WP-0019-T06)
+        working-directory: /tmp/repo
+        env:
+          REUSE_SURFACE_URL: https://reuse.coulomb.social
+        run: |
+          reuse-surface stats --format json > /tmp/stats.json 2>/dev/null || true
+          python3 -c "
+          import json
+          try:
+              hub = json.load(open('/tmp/stats.json')).get('hub', {})
+          except Exception:
+              hub = {}
+          if hub.get('stale_warning'):
+              print(f\"::warning::hub federated index is stale (composed_at={hub.get('composed_at')}, age_days={hub.get('age_days')}, threshold={hub.get('freshness_threshold_days')})\")
+          elif hub.get('configured'):
+              print(f\"hub federated index fresh (age_days={hub.get('age_days')})\")
+          else:
+              print('hub not reachable/configured in CI -- skipped')
+          " || true
+
       - name: Workstation roster federation stats (informational)
         working-directory: /tmp/repo
         run: |