docs: complete authenticated API pilot

docs/plans/workflow-system.md

@@ -55,7 +55,7 @@ restarted Kitty and closed the user's terminal session.
   native client with narrowly scoped certificate-verification exceptions; their
   exact example queries passed over TLS 1.3 in both environments. Direct test
   login and authenticated reads still return HTTP 200 for Yookr, rules, and
-  management.
+  management. Kulala login and response chaining are confirmed in Neovim.
 - Herdr ran the issue 197 planning pilot in two predictable, non-overlapping
   dashboard worktrees. Codex produced frontend commit `20f9d0f`; Claude produced
   backend commit `bd965ea`. Short, long, done, fallback-agent, and genuinely
@@ -67,21 +67,19 @@ restarted Kitty and closed the user's terminal session.
 
 These gates do not block work on each other.
 
-- Explicitly authorize the changed workbench `.envrc`, restart Neovim, and
-  visually confirm the MariaDB examples and Kulala response chaining. Create a
-  Marimo-to-HTML report only when a concrete cross-system investigation gives it
-  durable value.
+- Visually confirm the MariaDB examples in Dadbod. Create a Marimo-to-HTML report
+  only when a concrete cross-system investigation gives it durable value.
 - Keep Bruno, DBeaver, and PIM clients until their separate pilots decide them.
 - Route issue 197 to the actual account repositories before implementation;
   leave the two local dashboard planning branches available as evidence.
 
-The remaining Herdr observations are that detach and reattach preserve output,
-each completed event produces exactly one notification, and both worktree
-`.envrc` files receive explicit authorization. Short, long, approval-blocked,
-fallback-agent, predictable-path, non-overlapping-write, dirty-removal, and
-branch-retention behavior already passed. If a remaining component fails, fall
-back independently to native agent sessions and Codex TUI notifications or
-native `git worktree add/list/remove`; do not add a wrapper or Worktrunk yet.
+The remaining Herdr observations are that detach and reattach preserve output
+and each completed event produces exactly one notification. Short, long,
+approval-blocked, fallback-agent, predictable-path, non-overlapping-write,
+dirty-removal, and branch-retention behavior already passed. If a remaining
+component fails, fall back independently to native agent sessions and Codex TUI
+notifications or native `git worktree add/list/remove`; do not add a wrapper or
+Worktrunk yet.
 
 ## Deferred pilots
 
@@ -186,7 +184,6 @@ the fresh-shell GitHub read and restarted-Codex Context7 lookup must both work.
 
 ## Next step
 
-Activate the pending Neovim JavaScript-query mapping, authorize the changed
-workbench and pilot-worktree `.envrc` files, and confirm the two MariaDB examples
-inside Dadbod. Then confirm Herdr notifications and detach/reattach persistence,
-and run one real cross-system investigation without mutating company GitHub.
+Confirm the two MariaDB examples inside Dadbod. Then confirm Herdr notifications
+and detach/reattach persistence, and run one real cross-system investigation
+without mutating company GitHub.