chore(workplan): record CUST-WP-0067-T08 release build and remaining operator steps

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

workplans/CUST-WP-0067-hub-authority-target-resolution.md

@@ -348,6 +348,44 @@ is: merge, let CI build `main-<sha>`, then bump the tag *and* flip
 commit, then `helm upgrade`. The values file is deliberately left at
 `enabled: false` so an unrelated `helm upgrade` cannot ship a broken MCP.
 
-Noticed in passing, not part of this task: that values file pins
+**Release built (2026-08-24).** Pushing revealed why the image would not have
-`main-697dd49` while the cluster runs `main-76e6eda`. Declared and running
+rebuilt: the CI path filter matched `api/**` while the Dockerfile copies nine
-state disagree, which deserves its own look.
+more paths, so changes to `mcp_server/` — and to `migrations/`, which is the
+serious one, since a schema migration would not have shipped — merged to main
+without producing an image. Filter corrected to match the Dockerfile
+(`8221216`); run #284 succeeded and `main-8221216` pulls on the node.
+
+The production values file also drifted: it pinned `main-697dd49` while the
+cluster ran `main-76e6eda`, and it omitted `sweep.hostname`, which the live
+release carries — so deploying from that file alone would have silently dropped
+it. Both corrected; `helm template` from the file now renders byte-identical
+output to the intended release.
+
+**Remaining, both blocked on operator permission:**
+
+1. Commit and push `deploy/railiance/apps/helm/state-hub-values.yaml` (tag bump
+   plus `mcp.enabled: true`). The edit is on disk, uncommitted — the permission
+   classifier declined the commit twice.
+2. `helm upgrade` — also declined. Dry run is clean and adds only the
+   `state-hub-mcp` Deployment and ClusterIP Service:
+
+```bash
+cd ~/state-hub
+helm upgrade state-hub ./deploy/railiance/apps/charts/state-hub \
+  -n state-hub -f deploy/railiance/apps/helm/state-hub-values.yaml \
+  --wait --timeout 4m
+```
+
+Node headroom was checked first: CPU requests sit at 92% of ~4000m, leaving
+~320m. The MCP pod requests 50m, which keeps enough for the API's `maxSurge=1`
+roll.
+
+After the upgrade, verify from the node rather than through a tunnel:
+
+```bash
+ssh tegwick@92.205.62.239 'curl -sI http://<mcp-clusterip>:8001/sse'
+kubectl -n state-hub get pods -l app.kubernetes.io/component=mcp
+```
+
+Only once that serves may `state-hub-mcp-railiance01` be removed and the remote
+`dev-hub` registration repointed.