flips r2 to operational when sentinel returns null (404)

Prove the CareerVector ops + status workers honour their wire contracts without a live D1: the telemetry-tier gating on GET /workspaces/:id degrades correctly on expired/unbound projections, the services/finops/ status rollups never leak secret tokens, the /graph/ops projection emits only the nine canonical hub kinds and rejects behaviour→infra shortcuts, ops-mcp + status-mcp forward 1:1 to their API workers inside the admin boundary, the status api returns the public projection shape with no admin bindings, and the CORS contract only echoes the status.careervector.corbet.ch origin. The typed UI clients pin their production base URLs and request shapes.