finish three custodian workplans from live hub evidence

Close CUST-WP-0064 after the 2026-08-24 unassisted fire ingested
clay-borg, close CUST-WP-0065 now that all 120 active repos project a
classification, and close ADHOC-2026-08-25. Mark CUST-WP-0067 T02/T10
done (reverse relays already gone; work-record recovery lives on 0068).
Park the later no-checkout SBOM regression as CUST-IN-0015. Teach the
classification gate to use this host's checkout path.

workplans/CUST-WP-0064-sbom-controlled-scan-inputs.md

@@ -4,13 +4,13 @@ type: workplan
 title: "Controlled scan inputs for authoritative daily SBOM catch-up"
 domain: infotech
 repo: the-custodian
-status: active
+status: finished
 owner: codex
 topic_slug: custodian
 planning_priority: high
 planning_order: 64
 created: "2026-08-22"
-updated: "2026-08-23"
+updated: "2026-08-28"
 quality_dor: DoR-Ok
 quality_dor_at: "2026-08-22"
 quality_dor_by: codex
@@ -158,7 +158,7 @@ than the attended target set; T04 retains only the first unassisted fire.
 
 ```task
 id: CUST-WP-0064-T04
-status: progress
+status: done
 priority: medium
 state_hub_task_id: "664d90b0-1169-58fa-9a77-df53e739f957"
 ```
@@ -180,11 +180,29 @@ An operator-trigger through the existing Temporal schedule subsequently
 proved the production scheduled path and fleet summary without changing its
 weekday cadence. The first unassisted 09:15 Europe/Berlin fire remains.
 
+**Done (2026-08-28):** the first unassisted weekday fire ran at 2026-08-24
+07:15 UTC (09:15 Europe/Berlin) against the next oldest three. `clay-borg`
+ingested from `forgejo-archive-v1`:
+
+| Field | Value |
+|---|---|
+| snapshot | `63abb22f-0701-4d56-ba16-75bdff9362c4` |
+| repo | `clay-borg` |
+| revision | `18c57f2e9dce0589c1f0e24dd4d939aea50cee86` |
+| entries | 77 (`Cargo.lock`) |
+| provenance | archive sha256 `df9e5fac…`, 1_033_378 bytes |
+| siblings | `citation-work` and `config-atlas` terminal `no-manifest` at pinned SHAs |
+
+`never_count` is 76 (was 94 on 2026-08-23). Daily 07:15 UTC fires continued
+24–28 August. Residual: from 2026-08-25 the same schedule writes `no-checkout`
+again, so source-ref projection is not following later batches —
+`CUST-IN-0015`.
+
 ## Acceptance
 
 - [x] Production scans consume a controlled, revision-pinned source input
 - [x] No workstation filesystem is mounted or implicitly trusted
 - [x] Nexus remains the only authoritative snapshot writer
 - [x] One fire remains bounded to its original N targets across retries
-- [ ] At least one normal scheduled fire produces real ingested snapshots
+- [x] At least one normal scheduled fire produces real ingested snapshots
 - [x] Source cleanup, provenance, failure evidence, and rollback are verified