Add governed GRB refresh workflow

backend/README.md

@@ -1469,3 +1469,41 @@ Runtime controls are `SOURCE_CATALOG_PROBE_ENABLED`,
 `SOURCE_CATALOG_PROBE_CACHE_TTL_SECONDS`. Metadata links remain restricted to
 the official HTTPS CSW path on `metadata.vlaanderen.be` even when an operator
 overrides the capabilities endpoint.
+
+## Governed regional GRB refresh
+
+`GET /api/v1/projects/{project_id}/datasets/grb-refresh-plan` combines the
+explicit official GRB edition probe with the four existing regional snapshot
+series. It is read-only: it reports local feature/storage impact and whether
+buildings, roads, water and parcels are current, updateable or require review.
+
+Regional refreshes use a two-phase operator flow inside the all-in-one
+container. First stage and validate every source partition without touching
+PostGIS:
+
+```bash
+docker exec geointel python /app/scripts/manage_grb_refresh.py stage \
+  --project-id 82a85913-c522-45d7-84a1-02b393d89e55 \
+  --api-url http://127.0.0.1:8000/api/v1 \
+  --confirm-edition 2026-07-15 \
+  --layers buildings roads water parcels
+```
+
+The JSON result gives `plan_path`, exact feature deltas, artifact sizes and
+`plan_sha256`. Review that evidence, then apply those exact staged bytes:
+
+```bash
+docker exec geointel python /app/scripts/manage_grb_refresh.py apply \
+  --project-id 82a85913-c522-45d7-84a1-02b393d89e55 \
+  --api-url http://127.0.0.1:8000/api/v1 \
+  --confirm-edition 2026-07-15 \
+  --confirm-plan-sha256 SHA256_FROM_STAGE
+```
+
+Both commands fail when project/scope, official edition, manifests, partition
+count or any checksum differs. Interrupted staging is safely resumable because
+the existing municipal manifests are reused. Apply imports through
+DatasetService/VectorFeatureService, creates new temporal Datasets and retains
+all previous snapshots. Do not add `--force` to this coordinator; a source
+refetch remains a separate deliberate recovery action in the lower-level
+operators.