CUST-WP-0059: finish — T05 verified Forgejo CI + publish

Green kaizen ci #29 and tag publish #30 (v1.4.0 → Forgejo PyPI 200).
Documented substrate/secret fixes and mark workplan finished (6/6).

workplans/CUST-WP-0059-forgejo-ci-publish-cutover-tail.md

@@ -3,13 +3,13 @@ id: CUST-WP-0059
 type: workplan
 title: "Forgejo CI/publish cutover — retire residual gitea workflows"
 domain: infotech
-status: active
+status: finished
 owner: codex
 topic_slug: custodian
 planning_priority: medium
 planning_order: 59
 created: "2026-07-16"
-updated: "2026-07-16"
+updated: "2026-07-18"
 state_hub_workstream_id: "98d88a93-52d5-4bcb-9be3-6345e1b21785"
 ---
 
@@ -99,29 +99,28 @@ above). **Done 2026-07-16.**
 
 ```task
 id: CUST-WP-0059-T05
-status: todo
+status: done
 priority: high
-needs_human: true
 state_hub_task_id: "4a97eadb-7102-4658-b567-cc730e3ffaea"
 ```
 
-**De-risked 2026-07-16:** the Forgejo PyPI publish path is proven working —
-issue-core resolves at `/api/packages/coulomb/pypi/simple/issue-core/` (`200`),
-and `ubuntu-latest` is a registered Forgejo runner label. kaizen uses the
-identical pattern + org secrets, so its publish is high-confidence; it just needs
-its next `v*` tag to fire (kaizen simple index is `404` — nothing published since
-cutover). Remaining confirmation: one green kaizen `ci` run + one tagged publish.
+**Done 2026-07-18.** End-to-end verification on Forgejo:
 
-Confirm the new Forgejo workflows run end-to-end: (1) `FORGEJO_PYPI_USER` /
-`FORGEJO_PYPI_TOKEN` secrets are present (repo or org scope) on issue-core and
-kaizen-agentic; (2) the `ubuntu-latest` runner label resolves on Forgejo Actions;
-(3) a `v*` tag publishes to the Forgejo PyPI registry; (4) kaizen `ci.yml` passes
-(archive fetch + `pip install -e .[dev]` + black/flake8/pytest work on the runner —
-note the runner may lack git, hence archive fetch, and full-SHA archive URLs can
-hang per the state-hub image.yaml note). Fix runner label / secret gaps as found.
-
-**Done when:** a tagged kaizen-agentic release publishes to Forgejo PyPI and its
-Forgejo `ci` run is green.
+1. **Runner label:** `ubuntu-latest` → `railiance01-build-01` / `node:20-bookworm`
+   (works; smoke + real CI both schedule).
+2. **Secret gap fixed:** org secrets `FORGEJO_PYPI_USER` / `FORGEJO_PYPI_TOKEN`
+   were missing (only `REGISTRY_*` existed). Created on org `coulomb` using the
+   tegwick package-capable PAT (same identity that published issue-core 0.2.1).
+3. **CI substrate fix:** default image has python3 but no pip. Updated
+   `kaizen-agentic` (and issue-core publish) workflows to `apt-get install
+   python3 python3-pip` + short-SHA archive checkout (reuse-surface pattern).
+4. **flake8 blockers:** fixed pre-existing E501/F401/F541 so CI can go green.
+5. **Evidence:**
+   - kaizen `ci.yml` run #29 **success** on `d64e500` (black + flake8 + pytest)
+   - kaizen `publish-python-package.yml` run #30 **success** on tag `v1.4.0`
+   - package index `200`: `/api/packages/coulomb/pypi/simple/kaizen-agentic/`
+     → `kaizen-agentic 1.4.0` (creator tegwick, 2026-07-18T16:11:30Z)
+   - issue-core remains `200` at `/api/packages/coulomb/pypi/simple/issue-core/`
 
 ## Task: Align state-hub deployment tag with Forgejo CI output