security: locate legacy submodule objects without weakening coverage

docs/evidence/2026-10-13-netkingdom-security/forge-gitlink-local-copies.json

@@ -0,0 +1,13 @@
+{
+  "scope": "Commit-object existence only; no object content read, upload, restoration or scan.",
+  "checks": [
+    {
+      "submodule": "wiki",
+      "pinned_commit_present_in_workstation_copy": false
+    },
+    {
+      "submodule": "_issue-tracking/issue-facade",
+      "pinned_commit_present_in_workstation_copy": false
+    }
+  ]
+}

docs/evidence/2026-10-13-netkingdom-security/forge-missing-gitlink-object-search.json

@@ -0,0 +1,14 @@
+{
+  "scope": "Read-only commit-object existence search over the 167 directories in the post-expansion inventory; no remote fetch or content read. Does not cover deleted/unmanaged repositories or workstation copies.",
+  "target_pinned_commits": [
+    "70d7ec0cdcbdff1a41cc420e2c939f855fe7787b",
+    "8818df03d3d7be241c144fd839d90c4d7c0ba20a"
+  ],
+  "directories_checked": 167,
+  "matches": [
+    {
+      "repository_id": 13,
+      "target_index": 0
+    }
+  ]
+}

workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md

@@ -341,6 +341,16 @@ This closes the reproduced listener exposure only. Host jobs still share the
 privileged runner boundary; workflow authority, required detection checks and
 job-scoped credentials remain open in FORGE-WP-0006-T03 / RMGR-WP-0021-T03/T04.
 
+2026-10-13 submodule reconciliation: the four declared URLs use the retired
+forge NodePort. Two pins are reachable under their current canonical repository
+names. The wiki and issue-facade names are absent; a read-only object search
+across all 167 admitted-inventory directories found the issue-facade pin in
+repository ID 13, but no copy of the wiki pin. Neither pin is present in the two
+expected workstation submodule locations. This identifies further mapping and
+recovery work; no repository content was fetched, changed or uploaded, and no
+scanner exception was introduced. Receipts: `forge-gitlink-reconciliation.json`,
+`forge-missing-gitlink-object-search.json`, `forge-gitlink-local-copies.json`.
+
 ## Verify native closure against every requirement
 
 ```task