Add governed GRB refresh workflow

scripts/README.md

@@ -1716,6 +1716,42 @@ JSON output contains `source_freshness` and `catalog_probes`; without it, the
 original local report shape is unchanged. No flag downloads provider features
 or imagery and no flag writes a Dataset.
 
+## Governed GRB refresh
+
+Use the refresh coordinator only inside the GeoIntel container. The default
+`plan` action is read-only and prints the canonical decision from the API:
+
+```bash
+docker exec geointel python /app/scripts/manage_grb_refresh.py plan \
+  --project-id 82a85913-c522-45d7-84a1-02b393d89e55 \
+  --api-url http://127.0.0.1:8000/api/v1 \
+  --refresh-catalog
+```
+
+A refresh is deliberately split into two operator approvals:
+
+```bash
+docker exec geointel python /app/scripts/manage_grb_refresh.py stage \
+  --project-id 82a85913-c522-45d7-84a1-02b393d89e55 \
+  --api-url http://127.0.0.1:8000/api/v1 \
+  --confirm-edition 2026-07-15
+
+docker exec geointel python /app/scripts/manage_grb_refresh.py apply \
+  --project-id 82a85913-c522-45d7-84a1-02b393d89e55 \
+  --api-url http://127.0.0.1:8000/api/v1 \
+  --confirm-edition 2026-07-15 \
+  --confirm-plan-sha256 SHA256_FROM_STAGE
+```
+
+`stage` delegates to the existing buildings/context operators in fetch-only
+mode, validates every municipality partition and writes
+`/app/storage/operator-evidence/grb-refresh/<scope>/<edition>/staged-plan.json`.
+The plan contains exact feature-count deltas and artifact sizes. `apply`
+revalidates the entire plan and refuses any mismatched byte before delegating
+to the DatasetService-based persistence path. Existing snapshots are retained.
+The coordinator accepts no provider URL, collection name, arbitrary process or
+automatic schedule.
+
 ## Tower deployment
 
 Push the local branch to Gitea, then rebuild the Unraid/Tower Docker runtime: