feat: add API-only preflight signing delivery and rotation acceptance

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ed7-828d-7ca0-a8d4-0c3e5a0c4102

workplans/STATE-WP-0088-preflight-signing-runtime-acceptance.md

@@ -0,0 +1,50 @@
+---
+id: STATE-WP-0088
+type: workplan
+title: "Accept the platform preflight signing lane in the State Hub API"
+domain: infotech
+repo: state-hub
+status: active
+owner: codex
+topic_slug: infotech
+created: "2026-09-05"
+updated: "2026-09-05"
+related:
+  - RPF-WP-0035
+  - STATE-WP-0085
+  - FLEX-WP-0020
+quality_dor: DoR-Ok
+quality_dor_note: "Exact platform design and user-requested task reviewed against live primary; bounded API-only delivery and controlled-outage rotation fence."
+---
+
+## Wire and validate API-only delivery
+
+```task
+id: STATE-WP-0088-T01
+status: done
+priority: high
+```
+
+Chart opt-in `renamePreflight.enabled` adds a required explicit Secret ref only
+to the API container. Default disabled; no plaintext chart values or shared env
+Secret ownership. Helm rendering proves MCP/migration exclusion. Existing
+repository-rename API tests pass (13 tests). Platform owns CCR-2026-0015 and ESO.
+
+## Accept live signing and fenced rotation
+
+```task
+id: STATE-WP-0088-T02
+status: progress
+priority: high
+```
+
+Fresh live flex-auth -> access-engine preflight returns exactly the
+`preflight_signing_unavailable` blocker. Target is primary/railiance01,
+namespace/release/deployment state-hub, current API SA state-hub and one replica.
+After platform custody verification, enable the chart, prove API-only delivery,
+all-replica key equality, health and non-mutating signed preflight. Then stop all
+API replicas (including terminating pods), rotate with CAS through platform,
+wait ESO, restart and prove predecessor invalidation and forward recovery.
+Runbook: railiance-platform/docs/credential-lane-designs/state-hub-preflight-activation.md.
+No repository rename is in scope. Live completion is pending attended OpenBao
+OIDC/MFA; ambient session returned 403.