Add secure hosted production canary contract

[SoundBlaster]

Summary

• Add a digest-pinned, TLS-fronted hosted managed-operation production Compose profile.
• Add fail-closed host preflight, runtime health probe, private queue/artifact backup with real PostgreSQL restore smoke, queue-drain audit, and final canary sign-off.
• Link related issue/task (if any): Secure Hosted Runtime Deployment & Production Canary

Motivation

• The clean-VM runtime proved the single-node boundary but production TLS, secret ownership, backup/restore, reboot/replay, rollback, and sign-off remained prose-only.
• Production should not be declared ready from a successful queue receipt alone.

Goals

• Provide a reproducible production deployment contract and CI-enforced safety checks.
• Keep the initial allowlist limited to review_status_execute and preserve Platform reports as lifecycle authority.
• Actual DNS, certificate issuance, secret provisioning, host deployment, and production canary execution remain deployment-owned follow-up evidence.

Changes

• Add TLS-only Caddy ingress, internal service/PostgreSQL networking, worker-only egress, immutable image refs, and an isolated maintenance profile.
• Add sanitized preflight/probe/sign-off reports plus transaction-consistent private backup and temporary-database restore verification.
• Add production CI contracts, PostgreSQL integration coverage, rollout/rollback runbook, SLO targets, and roadmap status.

Validation

• Tests added/updated for changed behavior
• Local checks passed

Commands run:

make python-quality
make hosted-managed-production-contract
ruff check scripts/hosted_managed_runtime_backup.py scripts/hosted_managed_production_preflight.py scripts/hosted_managed_production_probe.py scripts/hosted_managed_production_signoff.py scripts/validate_hosted_managed_production_compose.py tests/test_hosted_managed_production.py
git diff --check

Results:

• 348 passed, 7 skipped in the full Platform suite.
• Production contract: 12 passed; Compose validation passed.
• Local Docker PostgreSQL integration could not run because the local Docker daemon stopped responding; the existing required PostgreSQL CI job now runs the real backup/restore test.

Risks / Notes

• Backward compatibility impact: existing local and standalone staging profiles are unchanged.
• Migration/config changes required: production needs digest-pinned images, TLS certificate/key, independent secret files, persistent artifact/state/backup roots, and the exact read-only allowlist.
• Known limitations: this PR creates the deployment and sign-off contract; it does not itself provision DNS/secrets or claim production sign-off.

Checklist

• PR title clearly describes the change
• Scope is focused and minimal
• Documentation updated (or N/A)
• Workflow/artifact changes distinguish artifact presence from readiness/status
• Temporary or intermediate paths are scoped to the current run/task where relevant
• No secrets or sensitive data added

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a1a430f36b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".