fix: restore workflow ownership and pilot gates

docs/workflow-discovery.md

@@ -1,7 +1,7 @@
 # Workflow system blueprint
 
-Status: implemented. Current external gates and operational handoff live in
-[`plans/workflow-system.md`](plans/workflow-system.md).
+Status: declarative core implemented; pilots remain. Current gates and the
+operational handoff live in [`plans/workflow-system.md`](plans/workflow-system.md).
 
 This document is the durable design for the workstation and surrounding Yookr
 workflow. Implementation history belongs in Git.
@@ -111,6 +111,8 @@ copied application state.
   the repository root, starts Neovim, and leaves a shell after Neovim exits.
 - Vivaldi remains the bookmark and web-app authority. Home Manager owns stable
   launchers for Actual, WhatsApp, and Outlook without duplicating browser state.
+  Its `Operations` folder owns visibly labeled test/live RabbitMQ bookmarks;
+  terminal inspection uses the Nix-provided `rabbitmqadmin-ng` on demand.
 - Niri keeps dynamic general-purpose workspaces and a compact navigation and
   movement vocabulary. The two-output active-workspace exchange remains a
   bounded pilot.
@@ -141,15 +143,18 @@ synchronization. The accepted `yookr-vpn.ovpn` is a narrow exception for Zenith
 and Polaris: keep it user-restricted and import it into NetworkManager without
 printing or committing its contents.
 
+`yookr-data-science/conf/local/credentials.yml` is a separate application-owned
+exception: Kedro resolves its named credential dataset through the conventional
+ignored `conf/local` hierarchy. Keep the file untracked and mode 0600; do not
+generalize the exception to other repositories.
+
 Only the user activates a NixOS or Home Manager generation. Agents may evaluate
 and build configurations, then provide an activation command.
 
 ## Remaining pilots
 
-- Capture Zenith's external display identity during a docked session and test the
-  two-output `Super+A` exchange.
-- Resume Evolution and Android PIM only when the user chooses to run those daily
-  use pilots.
+- Verify the labeled RabbitMQ test/live bookmarks and a read-only test overview
+  plus queue listing through an invocation-scoped `rabbitmqadmin-ng` run.
 - Add workbench database connections and a Marimo report only for a real
   cross-system investigation.
 - Configure an S3 remote only for a real task with least-privileged credentials
@@ -157,9 +162,20 @@ and build configurations, then provide an activation command.
 - Rerun the Yookr OpenAPI refresh after the deployed image exposes
   `/full-api-docs/openapi.json`; run authenticated API checks only with current
   user credentials.
+- Run the complete Herdr notification, fallback-agent, and safe worktree pilot
+  with a real Monday ticket.
 - Keep Bruno, DBeaver, and existing PIM clients until their independent gates are
   resolved.
 
+## Deferred pilots
+
+- Capture Zenith's external display identity during a docked session and test the
+  two-output `Super+A` exchange, including name and focus restoration on failure.
+- Resume Evolution and Android PIM only when the user chooses to run those daily
+  use pilots.
+- Replicate the proven workstation workflow on Polaris only when the user resumes
+  its machine-local VPN and credential procedure.
+
 ## Deferred work
 
 - Define the team release process and OpenAPI publication policy before encoding