feat: complete cluster self-sufficiency hardening

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a06d83-1cbc-71f2-b0dc-e0f48cedae43

docs/evidence/repository-registry-audit-20260904.json

@@ -0,0 +1,36 @@
+{
+  "schema": "state-hub.repository-registry-audit.v1",
+  "captured_at": "2026-09-04T19:50:00Z",
+  "source": "primary/railliance01 managed_repos database projection",
+  "workplan_task": "STATE-WP-0081-T05",
+  "counts": {
+    "repositories": 131,
+    "active": 126,
+    "active_missing_remote": 0,
+    "stale_gitea_remote": 0,
+    "workstation_local_path": 127
+  },
+  "repairs": [
+    {
+      "repo": "maturity-engine",
+      "field": "remote_url",
+      "value": "forgejo-remote:coulomb/maturity-engine.git",
+      "evidence": "verified origin of /home/worsch/maturity-engine"
+    }
+  ],
+  "archived_missing_remote": [
+    "markitect-project",
+    "railiance-bootstrap",
+    "railiance-hosts",
+    "vergabe_teilnahme"
+  ],
+  "interpretation": {
+    "local_path": "compatibility projection for workstation tools; not consumed by central Forge reconciliation",
+    "host_paths": "per-host checkout observations; not a cluster storage contract",
+    "central_source": "exact Forge commit fetched ephemerally by primary reconciliation"
+  },
+  "observations": [
+    "GET /repos/ did not return within 180 seconds; direct read-only database projection was used for this bounded audit",
+    "Archived records without a remote are retained as history and are not active reconciliation inputs"
+  ]
+}