docs: close invocation credential gate

docs/plans/workflow-system.md

@@ -30,8 +30,8 @@ not make it the global next step while another pilot can still progress.
 ## Current checkpoint
 
 - Tranche: autonomous consolidation across repositories, tools, and pilots
-- State: autonomous implementation exhausted; one activation and external or
-  real-use gates await the user
+- State: autonomous implementation exhausted; external and real-use gates await
+  their inputs
 - Branch: `chore/workflow-system`
 - Baseline: `nix flake check --no-build --quiet` and a no-link Zenith system
   build passed on 2026-09-06 after the invocation-scoped credential changes;
@@ -63,22 +63,24 @@ not make it the global next step while another pilot can still progress.
   Actions, and organization Project reads with no stored fallback credential.
   The user activated its loader and confirmed a new shell can list organization
   Projects; the skill directory and durable remote boundary are also live. The
-  new read-only wrapper fetches all private Cargo dependencies from inside a
-  cached dev shell, and the complete yookr-api contract passes.
-- Next: rotate the exposed Context7 key, create its machine-local file, and
-  activate the invocation-scoped GitHub and Context7 owners once. Then use the
-  first real Monday ticket to test the native Project-to-issue-to-local-branch
-  workflow and continue the remaining external pilots as inputs arrive.
+  activated read-only wrapper leaves `GH_TOKEN` out of cached dev shells while
+  `gh` identifies the work account and Git reads a private Cargo dependency;
+  the complete yookr-api contract passes. The replacement Context7 key is
+  mode 0600, the exposed key is revoked, and a live resolve-and-query round trip
+  passes through the activated runtime header helper.
+- Next: use the first real Monday ticket to test the native
+  Project-to-issue-to-local-branch workflow and continue the remaining external
+  pilots as inputs arrive.
 
 ## Progress
 
 | Batch | State | Evidence or blocker |
 | --- | --- | --- |
-| Bootstrap and repository ownership | Waiting for user | Repository reconciliation and local plaintext credential cleanup are complete; Context7 rotation remains |
+| Bootstrap and repository ownership | Complete | Repository reconciliation, local plaintext credential cleanup, and Context7 rotation pass |
 | Declarative workstation foundation | Complete | All-host builds pass with one Nixpkgs pin, `just`, and an explicit Podman Compose provider |
 | Repository contracts and workbench | Waiting externally | Five clean-checkout contracts, the full yookr-api check, and read-only Kubernetes pass; API user credentials, database, report, and S3 inputs remain externally gated |
 | Desktop navigation and interaction | Active | Walker project and terminal actions plus stable Actual/WhatsApp launchers work; Outlook and two-output checks remain |
-| Agent workflow | Waiting for user | Herdr, read-only PR review, the corrected skill owner, durable remote boundary, fine-grained credential, and organization Projects pass; the invocation-scoped owners await one activation and a real Monday ticket remains external |
+| Agent workflow | Waiting externally | Herdr, read-only PR review, the corrected skill owner, durable remote boundary, invocation-scoped credentials, and organization Projects pass; a real Monday ticket remains external |
 | Notes | Complete | The daily launcher and migrated notebook pass live checks; the approved rollback copy is recoverable from Trash |
 | PIM | Active | Native NixOS Evolution 3.60.2 plus Microsoft 365 integration is live beside Thunderbird; account and daily-use gates await credentials |
 | Transcription | Pending | Requires a real Fossify recording-transfer pilot before implementation moves from Zenith to Orion |
@@ -141,11 +143,6 @@ step to the user only when it blocks the current task.
 - Make one Fossify recording on the Pixel and let Syncthing transfer it. Do not
   rename or move it manually; the agent must first observe the real write and
   settlement behavior before implementing Orion automation.
-- Generate a replacement Context7 API key, save it without a trailing newline
-  as `~/.config/context7/api-key` with mode 0600, and revoke the old exposed
-  key. Then activate the latest Zenith build with
-  `cd ~/.config/nixos && nh os switch` and restart Codex. Only the user may
-  perform the activation.
 - Supply one real Yookr S3 task plus a least-privileged remote and authorize one
   bounded upload. `rclone` is prepared, but no remote or wrapper is guessed.
 - Deploy a GET image that exposes `/full-api-docs/openapi.json`, then rerun
@@ -385,16 +382,19 @@ Polaris:
   generated global `AGENTS.md` contained the strict remote-state policy, and
   the user confirmed `gh project list --owner yookrdev` succeeds. A cached
   nix-direnv shell then proved it strips inherited `GH_TOKEN`; this concrete gap
-  prompted the invocation-scoped wrapper above, which passes an isolated dev
-  shell API query and the full private-dependency build before activation.
+  prompted the invocation-scoped wrapper above. After activation, a cached dev
+  shell contains no `GH_TOKEN`, while `gh api user` identifies `jellespr` and
+  Git reads the private `constant-store` remote through the wrapper-backed
+  credential helper.
 - The former Context7 declaration put a literal key in
   `env_http_headers`, whose values Codex interprets as environment-variable
   names; it therefore exposed the secret without supplying the documented
   authentication. The static key is absent from the current worktree. Official
   Codex configuration and Context7 documentation instead support the built
-  `http_headers_helper`, which emits the required `Authorization: Bearer` header
-  and passes an isolated fake-key JSON test. The historical key still requires
-  revocation.
+  `http_headers_helper`, which emits the required `Authorization: Bearer` header.
+  The user replaced and revoked the historical key, the machine-local file is
+  mode 0600, and a restarted Codex session successfully resolves Nixpkgs and
+  queries its documentation through Context7.
 - The PR gate used `prediction-api#125`: native `gh pr view`, `checks`, and
   `diff` reads work, while an isolated exact-base reconstruction passes patch,
   whitespace, and Rust formatting checks and leaves no durable checkout. The PR