fix: publish RAGcore Procedure Sync and derive its evidence for real

MCP_HUB_BASE_URL had the same wrong-hostname bug as RAGCORE_BASE_URL earlier
this session (itworx-mcp-hub:8000 doesn't resolve; the real container is
reachable at the host's own 192.168.10.150:1100) -- fixed live, resolving the
Automation page showing "Operationeel" and "Hub Onbereikbaar" simultaneously.

Went on to actually publish the "Fleet Ops -- RAGcore Procedure Sync" n8n
workflow now that RAGcore is reachable: its own RAGcore Sync Token credential
had gone stale from the same rotation as the earlier one, so minted a fresh,
dedicated, minimally-scoped (sources:sync only) credential, verified a real
manual run (33 synced, 0 failed, result registered) before publishing.

That exposed a real, now-stale bug: derive_n8n_status() hardcoded this
workflow's evidence to None with a comment explaining it was unpublished --
true when written, false now. The workflow's own result-report callback
already writes a real n8n_procedures_synced audit event; wired that in as its
evidence source, the same pattern the scheduled scan and error handler already
use, instead of a value that could never update itself once the workflow went
live.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/tests/test_integration_status.py

@@ -119,8 +119,9 @@ def test_integration_status_lists_all_four_canonical_workflows(ops_client):
         "Fleet Ops — Workflow Error Handler",
     }
     ragcore_sync = next(w for w in body["workflows"] if "RAGcore" in w["name"])
-    # All 4 canonical workflows are built (RAGcore Procedure Sync has all 6 nodes saved
-    # live); it has no *run* evidence yet since it is deliberately left unpublished.
+    # All 4 canonical workflows are built (all 6 nodes saved live). This fresh test run
+    # has reported no real sync result yet, so -- like the other three workflows before
+    # their own first real signal -- there is no run evidence yet either.
     assert ragcore_sync["built"] is True
     assert ragcore_sync["last_seen_at"] is None
 

backend/tests/test_integrations.py

@@ -257,3 +257,10 @@ def test_procedures_sync_result_registers_and_is_idempotent(client, ops_client):
     matching = [e for e in audit_events if e["metadata"]["execution_id"] == execution_id]
     assert len(matching) == 1
     assert matching[0]["after"] == {"synced": 33, "failed": 1}
+
+    # The workflow's own callback is its evidence -- same pattern the scheduled scan and
+    # error handler already use -- so this real report must now show up as run evidence
+    # in the integration status, not stay hardcoded to "no evidence yet".
+    status = ops_client.get("/api/v1/integrations/status").json()["n8n"]
+    ragcore_sync = next(w for w in status["workflows"] if "RAGcore" in w["name"])
+    assert ragcore_sync["last_seen_at"] is not None