Catalog v6.2.0 groundskeeper: a scheduled component that keeps a standing demonstration estate from decaying. It plans by default, applies only when told to, and the estate carries no executable code. First release, hardened by an adversarial review (full manifest schema validation at load time, a documented field reference for every keeper kind) and by a live-fire fix to the iteration_horizon GraphQL query that the first real plan run surfaced. Also in this release: bots.yaml and a scheduled bot-maintenance audit that declare and check every standing credential in the group, and the ci-tools and ci-buildah images move to UBI10 for python 3.12 (ci-buildkit stays on UBI9; the reasons are recorded in the file).