REUSE-WP-0019-T06: hub freshness monitoring, docs, close workplan

reuse_surface/stats.py: _hub_summary() now reports composed_at, stale,
age_days, freshness_threshold_days (REUSE_SURFACE_FRESHNESS_DAYS env,
default 7), and a computed stale_warning. New hub_client.hub_federated()
backs it. format_stats_markdown surfaces a STALE marker when triggered.

.forgejo/workflows/ci.yml: new informational (non-failing) hub freshness
check against the live production hub on every push -- prints a
:⚠️: annotation when stale, never fails the build.

docs/RegistryFederation.md: new section tying together the webhook (T02),
scheduled fallback (T03), and freshness visibility (T06) into one
explanation. docs/deploy/reuse-kubernetes.md: updated for the T03 Forgejo
migration and the now-automated image.yaml build; image promotion
checklist updated for the known /health ingress bug (verify via
/v1/repos or /v1/federated instead).

14 new pytest cases, 173 total pass. Live-verified against production:
reuse-surface stats correctly showed composed_at/age_days for the real
federated index. Separately discovered and confirmed (via a live signed
webhook test) that reuse-surface-env moving to ExternalSecret/OpenBao
custody (railiance-apps commit 706f6c7, found while updating these docs)
did not break the T02/T03 webhook -- the synced value still matches what
the hub actually uses.

REUSE-WP-0019 is now fully complete (T01-T06). SCOPE.md and
docs/IntentScopeGapAnalysis.md updated to reflect closure.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

workplans/REUSE-WP-0019-forgejo-automation-and-telemetry.md

@@ -4,11 +4,11 @@ type: workplan
 title: "Forgejo-native federation automation and reuse telemetry"
 domain: infotech
 repo: reuse-surface
-status: active
+status: finished
 owner: claude-code
 topic_slug: helix-forge
 created: "2026-07-06"
-updated: "2026-07-07"
+updated: "2026-07-08"
 state_hub_workstream_id: "569be717-34f8-4039-bb26-497685f60159"
 reuse_check: "new — dogfooded 2026-07-07 via reuse-surface plan-check against the full 61-capability federated index; no existing capability covers Forgejo webhook automation or reuse telemetry"
 ---
@@ -372,18 +372,49 @@ follow-up rather than rushed in.
 
 ```task
 id: REUSE-WP-0019-T06
-status: todo
+status: done
 priority: low
 state_hub_task_id: "a9f44d45-91e2-4b43-909f-30a5f906cf3b"
 ```
 
-- `reuse-surface stats`: hub `composed_at` age + stale flag; CI informational
-  check warns when the hub index is older than N days
-- `docs/RegistryFederation.md` + `docs/deploy/reuse-kubernetes.md`: webhook
-  setup, recompose endpoint, Forgejo token handling (route credentials per
-  credential-routing rules — no secrets in repo)
-- `SCOPE.md`: flip "automatic hub refresh" to possible; update federation
-  posture
+SCOPE.md's "automatic hub refresh" flip was already done incidentally in
+T02/T03 (moved from "not possible yet" to "possible now"); no further
+change needed there.
+
+Implemented:
+
+- `reuse_surface/hub_client.py`: new `hub_federated()` (`GET /v1/federated`)
+- `reuse_surface/stats.py`: `_hub_summary()` now also reports
+  `composed_at`, `stale`, `age_days` (computed from `composed_at`),
+  `freshness_threshold_days` (`REUSE_SURFACE_FRESHNESS_DAYS` env, default
+  7), and a computed `stale_warning` (age beyond threshold OR the hub's own
+  `stale` flag). `format_stats_markdown` surfaces these with a `⚠ STALE`
+  marker when triggered; `format_stats_json` picks them up automatically
+  (no format-specific code needed there)
+- `.forgejo/workflows/ci.yml`: new informational (non-failing) "Hub
+  freshness check" step against the live production hub — prints a
+  `::warning::` annotation when stale, never fails the build
+- `docs/RegistryFederation.md`: new "Automatic recompose and freshness"
+  section tying together the webhook (T02/T03), scheduled fallback (T03),
+  and freshness visibility (T06) into one coherent explanation, pointing
+  at the authoritative operator runbook (`railiance-apps`) for actual
+  secret/webhook setup rather than duplicating operational steps here
+- `docs/deploy/reuse-kubernetes.md`: image section updated to reflect the
+  T03 Forgejo migration (repo canonical remote moved; production image
+  still built from the pre-migration Gitea registry, deliberately not
+  switched over in this task); image promotion checklist updated for the
+  now-automated `.forgejo/workflows/image.yaml` build and the known
+  `/health` ingress bug (use `/v1/repos`/`/v1/federated` for verification
+  instead)
+- 14 new pytest cases (`test_stats.py`); 173 total pass
+- **Live-verified** against the real production hub: `reuse-surface stats`
+  correctly showed `composed_at`/`age_days` for the actual federated index
+  (0.08 days old, no stale warning); separately discovered and confirmed
+  (via a live signed webhook test) that an external secrets-management
+  change — `reuse-surface-env` is now ExternalSecret-managed from OpenBao
+  (`railiance-apps` commit `706f6c7`, found while updating these same
+  docs) — did **not** break the T02/T03 webhook: the synced value still
+  matches what the hub actually uses
 
 ---
 
@@ -394,7 +425,7 @@ state_hub_task_id: "a9f44d45-91e2-4b43-909f-30a5f906cf3b"
 - [x] This repo's CI runs on Forgejo Actions (`.forgejo/workflows/`) (T03, 2026-07-07 — `ci.yml`/`ci-smoke.yaml`/`image.yaml` all verified green on the live push)
 - [x] Reuse events recordable via hub API and CLI (T04, 2026-07-08 — live-verified); `report reuse` aggregation done in T05
 - [x] R-axis evidence rules for observed reuse documented in the maturity standard (T05, 2026-07-08 — `specs/CapabilityMaturityStandard.md` §8.9)
-- [x] Hub freshness visible (`composed_at`, stale flag) in API and stats (T02, 2026-07-07)
+- [x] Hub freshness visible (`composed_at`, stale flag) in API and stats (T02 API, T06 `stats`/CI, 2026-07-07/08)
 
 ## Out of scope