feat(workplan): close CUST-WP-0067 T04 and T05, open T09

rmgr repo-onboard is the missing managed_repos write path. 33 of 44 cache-only
repositories onboarded to central (78 -> 111); the other 11 carry written
dispositions rather than guessed classifications.

T04 uncovered why onboarding only worked from a workstation: the hub resolved
its classification allowed-values file from hardcoded developer checkouts, so
every classification write 500'd in the container. T09 delivers that file.

The local cache database must not be discarded yet — 11 records live only there.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/recovery/onboarding-disposition-2026-08-24.md

@@ -0,0 +1,54 @@
+# Disposition — repositories not onboarded to central
+
+CUST-WP-0067-T05, 2026-08-24. Of the 44 cache-only repository records, 33 were
+onboarded to central via `rmgr repo-onboard`. Central went from 78 to 111
+repositories. These 11 did not, each for a reason that needs a decision rather
+than a retry.
+
+| Repository | Reason | Needed |
+|---|---|---|
+| `agent-harness` | no working copy on this machine | restore from remote, or drop |
+| `binky-control` | no `.repo-classification.yaml` | author with the repo owner |
+| `clay-borg` | no `.repo-classification.yaml` | author with the repo owner |
+| `direkt-vermittlung-de` | no `.repo-classification.yaml` | author with the repo owner |
+| `polycode-sim` | no `.repo-classification.yaml` | author with the repo owner |
+| `railiance-telemetry` | no `.repo-classification.yaml` | author with the repo owner |
+| `ralph-workplan` | no `.repo-classification.yaml` | author with the repo owner |
+| `rein-openweights` | no `.repo-classification.yaml` | author with the repo owner |
+| `soul-frame` | commits not pushed | owner decides whether to publish |
+| `testdrive-jsui` | no `.repo-classification.yaml` | author with the repo owner |
+| `timeline-svg` | no `.repo-classification.yaml` | author with the repo owner |
+
+## Why these were not forced
+
+Classification is not mechanical (`CUST-WP-0065-T01`): the sector domain
+describes intended users, and guessing it produces a confident wrong answer
+that is harder to correct than a missing one. Nine repositories need a
+classification file authored with their owner.
+
+`soul-frame` has three unpushed commits carrying research content. Onboarding
+correctly refused — a hub record whose backing file is only local cannot be
+re-derived — but publishing someone's unpublished work is an owner decision,
+not a side effect of onboarding. Once pushed:
+
+```bash
+uv run --project ~/repo-manager rmgr repo-onboard \
+  --path ~/soul-frame --api-base http://127.0.0.1:8000
+```
+
+`agent-harness` has no working copy here at all and must be restored from its
+remote or explicitly dropped. Do not preserve it as a hub-only record — that is
+the `ADR-001` violation `ADR-010` calls out.
+
+## Classification is deferred for all 33
+
+Every onboarded record carries its domain but no classification fields. The
+hub returned 500 on each classification write because `api/classification.py`
+resolved its allowed-values file only from developer workstation checkouts, so
+in the container none exist. Fixed by `REPO_CLASSIFICATION_ALLOWED_PATH`
+(state-hub `05dda8d`), which still needs the canon file delivered into the pod
+and the variable set — tracked as `CUST-WP-0067-T09`.
+
+The records are correct and re-derivable in the meantime: the classification
+files are committed and pushed, so re-running onboarding projects them once the
+hub can validate.