fix(sre): finalize local automation release candidate

docs/operations/sre-k3s-controlled-automation-work-items.snapshot.json

@@ -919,7 +919,7 @@
       "title": "Gitea CD、production runtime 與 visible closure",
       "owner_lane": "ReleaseControl",
       "risk": "high",
-      "status": "planned",
+      "status": "in_progress",
       "dependencies": [
         "AIA-SRE-001",
         "AIA-SRE-002",
@@ -938,12 +938,17 @@
       "verifier": "deploy marker, image SHA, API readback and desktop/mobile smoke",
       "rollback": "previous immutable image revision and ConfigMap source SHA",
       "exit_condition": "source/test/CD/runtime/UI evidence all match one deployed SHA; gitea-native exact metrics are fresh and the retired legacy GitHub exporter is absent from production",
+      "confirmed_truth": [
+        "the local release candidate is merged with the latest observed gitea/main and passes the CD-equivalent non-integration API gate with 5666 passed and 23 skipped, including the 977-test changed-file suite; 4 focused web tests, web typecheck and JSON/YAML parsing also pass",
+        "stale Telegram tests that required unobserved OpenClaw/NemoTron/ElephantAlpha labels, a promotional check/apply/verify/writeback string or an unreceipted 88 percent confidence were replaced by no-false-AI receipt and actual stage-state contracts; receipt-backed provider, Agent99 executor, verifier and KM/MCP evidence remain visible",
+        "the Solver, RecommendedAction schema and callback registry now agree that host/systemd actions use the controlled provider and host_ansible_reconcile typed route instead of generic SSH fallback"
+      ],
       "runtime_gaps": [
         "no program item is runtime closed for this source SHA",
         "gitea-native exact target is missing while legacy GitHub exporter runtime drift remains",
-        "source/test readiness, CD terminal, production runtime and visible UI evidence are separate incomplete layers"
+        "local source/test readiness is complete, but no normal push, CD terminal, deploy marker, production runtime or visible UI/Telegram evidence exists for this candidate"
       ],
-      "next_action": "commit phase 1, normal push after shared writer release, then terminal CD plus production API/runtime/UI readback and exact gitea-native/legacy-exporter verification"
+      "next_action": "hand the exact local candidate SHA to the authorized release lane for one normal push after shared-writer coordination, then require terminal CD plus production API/runtime/UI/Telegram readback and exact gitea-native/legacy-exporter verification"
     }
   ],
   "rollups": {
@@ -954,7 +959,7 @@
     },
     "by_status": {
       "source_implemented_runtime_pending": 17,
-      "planned": 1
+      "in_progress": 1
     },
     "source_implemented_items": 17,
     "runtime_closed_items": 0,