docs: record RAGcore credential re-attempt and its concrete failure evidence

User explicitly authorized issuing the RAGcore credential directly this
round. Retried via the admin UI (Platform Admin role) after the earlier
raw-API attempt; both fail with an opaque server-side rejection carrying
a trace ID. Documents this as a RAGcore-side blocker, not a Fleet Ops gap.

n8n/workflows/MANIFEST.md

@@ -37,11 +37,19 @@ credential values are never embedded; nodes reference named n8n credentials inst
 ## 3. Fleet Ops — RAGcore Procedure Sync
 
 Not yet built. Blocked on a RAGcore application credential (scope `sources:sync`) for the
-`fleet-ops` application, to be provided by the project owner. Will sync
+`fleet-ops` application. Two independent issuance attempts have failed with an opaque
+server-side rejection: the raw API (`POST /v1/applications/{id}/credentials`, 400
+"authoritative service-account state rejected issuance") and the RAGcore admin UI's
+"Issue credential" form as the Platform Admin role (generic "Something went wrong",
+trace reference `1955c6a8968c4941a22a1faef39e17a7`). The `fleet-ops` application itself
+shows as ordinary/`Active` with no visible lock in the RAGcore admin UI, and the OpenAPI
+spec documents no validation constraint that would explain either rejection — this is a
+RAGcore-side policy or bug, not a Fleet Ops request-shape or permission problem. Needs
+RAGcore's own operator to look up the trace IDs above in RAGcore's logs. Will sync
 `n8n/workflows/fleet-ops-ragcore-procedure-sync.json` against the real RAGcore contract
 (`POST /v1/uploads`, `GET /v1/knowledge-spaces`, etc. — see
 `contracts/ragcore-contract-assumptions.md` and the live inspection notes in
-`docs/live-ai-integration/n8n-current-state.md`).
+`docs/live-ai-integration/n8n-current-state.md`) once a working credential exists.
 
 | Field | Value |
 |---|---|