docs(publisher-services): reconcile BE-02 post-merge state

[ja573]

BE-02-CLOSEOUT-01 — post-merge control correction

Bounded documentation and control correction of the materially stale active
Publisher Services programme and dependency state left after the BE-02
implementation merged.

Risk: LOW. Documentation only. No runtime, schema, migration, API, generated
contract, client artifact, workflow, deployment or production effect.

Why this task exists

ADR-0005 prohibits recursive lifecycle-metadata pull requests, and section 8
of that ADR requires a bounded post-merge correction when a committed tracker
holds materially incorrect programme state. That is the condition here.

The material correction is programme and dependency state, not lifecycle
metadata:

• task-status.md recorded BE-02 as
  IMPLEMENTED - AWAITING INDEPENDENT REVIEW / MERGE AUTHORIZATION with PR feat(publisher-services): implement BE-02 distribution platforms #805
  (DRAFT, unmerged) — wording ADR-0005 section 6 names explicitly as
  prohibited;
• README.md, decisions.md, rollout-plan.md, platform-inventory.md and
  control-gaps.md each asserted that BE-02 "remains blocked and unauthorized";
• platform-inventory.md and control-gaps.md asserted that no runtime
  DistributionPlatform implementation exists;
• BE-03, BE-04, MIG-01, DIS-01 and EXP-01 listed BE-02 as an unsatisfied
  blocking dependency.

No review identifier, approval identifier, merge-authorization identifier,
merge commit SHA or merge timestamp is transcribed into any repository file.
GitHub remains the terminal lifecycle authority under ADR-0005. Historical
evidence, including the BE-02 implementation report's explicitly
implementation-time sections, is preserved as written.

Durable state now recorded

BE-02:                          CLOSED - INACTIVE FOUNDATION
BE-02 repository implementation: merged
BE-03 dependency on BE-02:      SATISFIED
BE-03 implementation:           NOT AUTHORIZED
Deployment:                     NOT AUTHORIZED
Environment migration execution: NOT AUTHORIZED
Production migration:           NOT AUTHORIZED
Assignment creation/backfill:   NOT AUTHORIZED
Distribution activation:        NOT AUTHORIZED
OBSERVE / ENFORCE:              NOT AUTHORIZED
PR #799:                        UNTOUCHED
Issue #765:                     UNMODIFIED

Method

A classified stale-state search was performed over the active Publisher
Services and engineering control surface — no global find/replace. Every BE-02
statement was read in context and classified ACTIVE STALE STATE - CORRECT,
HISTORICAL RECORD - PRESERVE, CURRENT AND CORRECT - PRESERVE or
OUT OF SCOPE - PRESERVE. The complete findings are in section 10 of the
implementation report.

Two statements naming BE-02 were deliberately not changed:
BE-02 runtime: NOT AUTHORIZED in the CG-13 activation block of
control-gaps.md, and the identical statement in the ai-delivery index. Every
entry in that block is a production activation transition, and BE-02 runtime
activation remains unauthorized, so both remain true after the merge. Reviewers
should check that judgement.

Authorization

Explicit CTO instruction, transcribed by the authoring agent as a top-level
comment on merged PR #805. That comment is a transcription only: not an
independent review, not a review decision, and not merge authorization
(#805 is already merged, and its historical body and comments are unmodified).

Files

• docs/publisher-services/task-status.md
• docs/publisher-services/README.md
• docs/publisher-services/decisions.md
• docs/publisher-services/rollout-plan.md
• docs/publisher-services/platform-inventory.md
• docs/engineering/repository-map/control-gaps.md
• docs/engineering/ai-delivery/tasks/BE-02-CLOSEOUT-01.md (new)
• docs/engineering/ai-delivery/implementation-reports/BE-02-CLOSEOUT-01-implementation-report.md (new)
• CHANGELOG.md

Validation

git diff --check                -> clean, exit 0
path containment                -> docs/** plus CHANGELOG.md only; no
                                   thoth-api/, thoth-client/, migrations/,
                                   Cargo.* or .github/ path
relative links                   -> all resolve
changelog                        -> one entry under existing
                                    ## [Unreleased] / ### Added

The full workspace gate was not run and is not required: root AGENTS.md
section 8 prescribes git diff --check plus documentation verification for a
documentation-only change, and no file under any workspace member is modified.

Not included

BE-03, BE-04, MIG-01, APP-01, OAI, Metrics, LIC-01/LIC-02, deployment, release,
production migration, assignment backfill, distribution activation,
OBSERVE/ENFORCE, mutation-guard changes, PR #799 and issue #765.

This pull request remains a draft and is subject to its own independent review
and separate merge authorization.

[ja573]

CONTROL PROVENANCE - BE-02-CLOSEOUT-01

Independent review provenance (external fresh reviewer; transcribed here by the control agent, not submitted as a GitHub approval by the authenticated account):

• Decision: APPROVED
• Findings: NONE
• Exact reviewed head: 1f2cb585b25336ab9806adaeff9538b1ac3fa8ea
• Review verified the complete 9-file documentation/control diff, ADR-0005 compliance, preservation of historical evidence, the CG-13 BE-02 runtime: NOT AUTHORIZED boundary, and exact-head docs-only CI/classifier behaviour.

CTO merge authorization (explicitly provided to the control agent):

• Authorized PR: docs(publisher-services): reconcile BE-02 post-merge state #807
• Authorized exact head: 1f2cb585b25336ab9806adaeff9538b1ac3fa8ea
• Target: develop
• Scope: repository integration only.

This authorization does NOT authorize deployment, environment or production migration execution, backfill, distribution activation, OBSERVE/ENFORCE, production access, or any action on PR #799.

Any head change invalidates the review/authorization binding and requires a fresh exact-head check before merge.