queue: record Q14 re-verification and mark its render finish line still open

WORK-QUEUE.md

@@ -405,3 +405,15 @@ to staged `index.html`. `caddy validate` passes and the pre-change file is retai
 numbers above. The public-repository blocker is unchanged: the raw seed still answers anonymously with HTTP 200,
 so no additional pending state goes into this repo. Hardening follow-up: narrow the authenticated file-server root
 before placing any non-page build artifacts there.
+
+**Re-verified 2026-09-26 ≈18:20 UTC by a later run, and one limit recorded.** Anonymous fetches of four paths on
+that vhost — the page path and three files served from the same root, including the seed copy — all return **HTTP
+401**; `systemctl is-active caddy` → `active`; `caddy validate --config /etc/caddy/Caddyfile` → `Valid
+configuration`. What I could **not** reproduce is the authenticated 200 and the body hash above: the credential is
+not stored on this host, so that part stands on the run that created the gate, not on this one. Therefore **Q14 is
+not finished by its own criterion**: the mobile-width render against the live URL has not been performed, and the
+credential handoff to Alexander is unverified from this host. Also carried forward: `/opt/inbox-site` holds
+`seed.json`, `build_page.py` and two render PNGs beside `index.html`; they sit behind the same credential but are
+not page artifacts and belong off that root the next time the page is touched. Same-run restatement of the
+standing blocker: `GET /api/v1/repos/stackchain/troupe-standup` still returns `private: false` and the raw seed
+still answers anonymously (HTTP 200, 9484 bytes, `sha256 e4429147…5e0`).