CTRL-DELIVERY-01-CLOSEOUT-01: reconcile merged Shared Engineering Control rollout state

[ja573]

Owning issue: #819
Parent programme: #818
Task: CTRL-DELIVERY-01-CLOSEOUT-01

Authorized base: develop @ e70fd5e04f9ee8d6b0dfb85ff14ef3b0622fdab2 (actual base identical).

Purpose

Reconcile the remaining Shared Engineering Control rollout and control-gap records with the repository-local controls that have already been independently reviewed and merged in the managed repositories.

Live re-verification (2026-08-15)

Each instruction PR is merged, each merge commit is the current branch head, and a root AGENTS.md is present at that head:

Repository	Branch	Verified head	PR	Merged
thoth-app	dev	7a4e7c6ceaec36fbdb201eaeb9ae36985a709889	#114	2026-08-15T12:05:32Z
thoth-dissemination	develop	71ef7724326e9e75ccea2c004b5ca5be8197f27e	#96	2026-08-15T13:02:31Z
thoth-client (standalone)	develop	d6ffdc67c48cbf64f8a716f26d7d82eb541d1ecf	#55	2026-08-15T13:46:31Z
thoth-pyramid	dev	2ee7a71f068db828a547fb60627d5a89243d209d	#15	2026-08-15T16:48:57Z
thoth-strapi	develop	306220326189697252a708a203d6b4cc02f018cc	#5	2026-08-15T17:53:41Z
thoth-sphinx	develop	ff7de985d03f0c94d5ad8d60727f9cf85b6435cd	#4 (reconciliation)	2026-08-15T18:29:45Z

metrics-dashboard, metrics-widget and cc-license were re-verified as still having no root AGENTS.md on any branch, so they remain outstanding.

Scope — exactly three modified files

M CHANGELOG.md
M docs/engineering/agent-instructions/rollout-plan.md
M docs/engineering/repository-map/control-gaps.md

No additions, deletions, renames or moves. docs/metrics/README.md is deliberately not touched — its stale Sphinx wording belongs to the Metrics programme and requires separate authorization.

What changed

• rollout-plan.md — the current-state table no longer says thoth-app has no verified root AGENTS.md, nor that thoth-dissemination still needs its repository-local control revision. Rows added for the completed standalone thoth-client, thoth-pyramid and thoth-strapi so the record does not omit them in a way that implies they remain outstanding. Rollout-sequence steps 2 and 3 replaced with the merged, authoritative state.
• control-gaps.md — CG-05 narrowed to the repositories that genuinely remain outstanding, with the merged repository/branch/head/PR evidence recorded.

Boundaries preserved (nothing else closed)

• CG-03 remains OPEN for Sphinx branch normalization and bootstrap readiness;
• BR-SPHINX-01 and SPHINX-BOOT-01 remain separate;
• branch-topology normalization, including BR-APP-01 and BR-DIS-01, remains separate;
• CG-11 CI gaps, Pyramid's dev-target CI gap and Strapi's Docker/Node CI defect remain separate;
• dissemination's README/environment-protection contradiction remains a separate follow-up;
• CG-08 Metrics readiness and Metrics-specific documentation remain a separate programme.

Historical implementation reports and point-in-time records were not rewritten.

Effects

Class	Effect
Database / migration	NONE
API / GraphQL / runtime contract	NONE
Auth / security implementation	NONE
Provider / runtime	NONE
Other repositories	NONE

Documentation and control records only.

Validation

• git diff --check clean;
• whole-task diff against the authorized base contains exactly the three M entries above;
• relative markdown links in all changed files resolved against the working tree;
• terminology/status sweep found no remaining claim that App controls are absent or Dissemination controls incomplete;
• all thirteen CG headings intact; CG-03 and CG-13 still OPEN.

---

CLOSEOUT RECONCILIATION IMPLEMENTATION COMPLETE - FRESH INDEPENDENT REVIEW REQUIRED

This PR stays DRAFT. Not self-approved, not marked ready, not merged.