feat(workplan): add CUST-WP-0067 T07 fleet port-map repoint, T08 central MCP

Remote repointing turned out to be larger than a config change. The port map
is prose copied into ~120 AGENTS.md files with no generator behind it, and the
Helm chart deploys no MCP server on central, so remote dev-hub exists only as
a reverse tunnel to the workstation.

Global agent instructions repointed to the in-cluster ClusterIP; the two
reverse tunnels stay until T07 and T08 remove what depends on them.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

workplans/CUST-WP-0067-hub-authority-target-resolution.md

@@ -258,3 +258,64 @@ this record class and record the local-instance retirement as the outcome.
 
 Acceptance: ADR-010 revised with a dated superseding note linked to this
 workplan; `ops-bridge` and the port map documented as the structural fix.
+
+## Repoint the fleet's copied port map
+
+```task
+id: CUST-WP-0067-T07
+status: todo
+priority: high
+```
+
+The remote port map is not configuration. It is prose copied into roughly 120
+`AGENTS.md` files across both machines, with no template or generator behind it
+— a grep for the block finds only the files themselves and past agent session
+logs. That is how one wrong topology propagated fleet-wide and survived the
+primary moving off the workstation.
+
+Every copy still tells a remote agent to reach the hub at `127.0.0.1:18000`,
+which forwards back to the workstation. The global agent instructions are
+already repointed to the in-cluster address (2026-08-24); these copies are not,
+and they outrank nothing but are read first in their own repos.
+
+Two things are needed, and the second matters more than the first:
+
+1. A scripted, reviewable repoint of the block across all affected repos on both
+   machines — mechanical, but 120 repos times commit and push, so it needs a dry
+   run and a diff sample reviewed before it runs.
+2. A single source for the block, so the next topology change is one edit rather
+   than 120. Repo Manager already owns repository representation and `scaffold`;
+   this belongs there. Without it this task recurs verbatim.
+
+Retiring `state-hub-railiance01` is blocked on this: the tunnel is what those
+120 files currently depend on.
+
+Acceptance: no `AGENTS.md` instructs a remote agent to use `127.0.0.1:18000`;
+the block has one authoritative source; a spot check on both machines confirms
+the rendered guidance matches the live topology.
+
+## Deploy an MCP server on central
+
+```task
+id: CUST-WP-0067-T08
+status: todo
+priority: medium
+```
+
+The Helm chart deploys a single container serving HTTP on 8000. No MCP server
+runs on central, so `dev-hub` for remote agents exists only as a reverse tunnel
+to the workstation's MCP — which now proxies central, making the path
+remote → workstation → central for a service on the remote's own machine.
+
+The work is small: the same image already contains `mcp_server/server.py`, run
+with `MCP_TRANSPORT=sse MCP_PORT=8001` and `API_BASE` pointed at the in-cluster
+service. It needs a Deployment, a Service, and chart values.
+
+Until this lands, remote agents should prefer the REST surface; the session
+protocol documents a `curl` form for every operation, so this is a degraded
+convenience rather than a blocker. Retiring `state-hub-mcp-railiance01` is
+blocked on this task.
+
+Acceptance: an MCP endpoint reachable from the node without traversing the
+workstation; remote `dev-hub` registration points at it; the reverse MCP tunnel
+removed.