feat(workplan): CUST-WP-0067-T07 files repointed on both machines

178 AGENTS.md files moved off the 127.0.0.1:18000 reverse tunnel to the
in-cluster address; both machines report zero stale rows. 100 pushed from the
workstation, 74 picked up by pull on the node, 4 handled individually.

binky-control committed but not pushed — it carries 6 pre-existing unpushed
commits that are not this change's to publish. activity-core was already 39
behind with an unrelated dirty file; only AGENTS.md was taken from origin.

state-hub-railiance01 is now unblocked for removal.

Still open: the block has no single source, so this recurs on the next
topology change; and 68 non-AGENTS.md references need individual judgement
rather than substitution.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/recovery/tunnels-yaml-proposed-changes-CUST-WP-0067.md

@@ -53,10 +53,10 @@ Status 2026-08-24:
 
 - `state-hub-mcp-railiance01` — **safe to remove now.** Central MCP is serving
   and the global port map points at it.
-- `state-hub-railiance01` — **not yet.** The global instructions are repointed,
-  but roughly 120 `AGENTS.md` files across both machines still tell agents to
-  use `127.0.0.1:18000`. Removing it before `CUST-WP-0067-T07` repoints those
-  breaks any session that follows its own repo's instructions.
+- `state-hub-railiance01` — **safe to remove as of 2026-08-25.** All 178
+  `AGENTS.md` files on both machines are repointed to the in-cluster address and
+  both machines report zero stale rows. Nothing documented still points at this
+  tunnel.
 
 On railiance01 both services are reachable in-cluster with no tunnel at all —
 this is where "abandon tunneling" genuinely applies.