chore(security): reopen Cloudflare replacement rotation

docs/release-control/v6/internal/records/historical-credential-containment-execution-2026-08-08.md

@@ -128,8 +128,10 @@ uses the scoped token. The scoped token passed the provider's active-token
 verification and successfully read the current Pages project inventory. The
 invalidated global key was removed from the protected local credential source,
 which now retains only the scoped-token path and non-secret account metadata.
-No replacement global key was retrieved or persisted.
+No replacement global key was retrieved or persisted. A later local diagnostic
+rendered the scoped token outside its protected source, so that replacement is
+being rotated before the prerelease gate can close.
 
-Disposition: provider `revoked`; replacement `validated`.
+Disposition: provider `revoked`; replacement pending scoped-token rotation.
 
 No history rewrite was performed or is required for provider containment.

docs/release-control/v6/internal/status.json

@@ -8045,7 +8045,7 @@
       "owner": "release-owner-and-provider-owners",
       "blocking_level": "rc-ready",
       "minimum_evidence_tier": "production-observed",
-      "status": "passed",
+      "status": "owner-action",
       "verification_doc": "docs/release-control/v6/internal/HIGH_RISK_RELEASE_VERIFICATION_MATRIX.md",
       "lane_ids": [
         "L1",
@@ -8320,20 +8320,6 @@
               }
             ]
           },
-          {
-            "subject_id": "PRO-CLOUDFLARE-01",
-            "disposition": "validated",
-            "recorded_at": "2026-08-08T16:22:17Z",
-            "verifier": "credential-containment-audit",
-            "evidence": [
-              {
-                "repo": "pulse",
-                "path": "docs/release-control/v6/internal/records/historical-credential-containment-execution-2026-08-08.md",
-                "kind": "file",
-                "evidence_tier": "production-observed"
-              }
-            ]
-          },
           {
             "subject_id": "PRO-DIGITALOCEAN-01",
             "disposition": "validated",