chore: establish clean-clone self-hosted release gate and operational readiness

[parthrohit22]

Task

Create a repeatable clean-clone acceptance gate for the supported self-hosted stack. The audit verified components and CI jobs, but Docker was unavailable locally, Redis-backed behaviour was not exercised, and backup/restore, readiness, and failure recovery were not demonstrated as one deployable workflow.

This issue is a release/operations gate. It does not replace #93's durable job implementation or #110's migration fix.

Rationale

PARTHA's intended private/self-hosted market requires more than passing isolated unit tests. A maintainer must be able to clone the repository, configure the documented environment, start the stack, migrate the database, complete the owner-isolated proof workflow, recover from a restart, and understand what is ready or failing.

References

• Audit coverage ledger: Docker and Redis were not run locally; backup/restore and observability remain unverified.
• chore: move repository analysis to a durable cancellable job lifecycle #93: durable jobs, stale-worker handling, and resource budgets.
• security: enforce outbound AI provider egress policy (P0-03) #109: provider egress policy before shared deployment.
• bug: alembic upgrade crashes when DATABASE_URL contains '%' (env.py interpolation) #110: percent-encoded database URL migration regression.

Implementation Notes

• Add a CI or scripted acceptance workflow that starts the documented Postgres/Redis/application stack from a clean checkout.
• Exercise migrations, health/readiness, registration/login, owner isolation, analysis lifecycle, and the first evidence-backed consumer once chore: deliver evidence-backed authentication architecture explanation #95 lands.
• Include a migration URL containing legal percent-encoding after bug: alembic upgrade crashes when DATABASE_URL contains '%' (env.py interpolation) #110 is fixed.
• Verify restart/recovery, bounded cleanup, logs without secrets, and snapshot backup/restore once sealed snapshots are produced.
• Keep the workflow deterministic and disposable; never use production credentials or shared data.

Acceptance Criteria

• A clean checkout can start the documented stack with one reproducible command sequence.
• Postgres and Redis paths are exercised in CI or an equivalent isolated acceptance environment.
• Readiness checks distinguish unavailable, starting, and ready services.
• Migration up/down or upgrade validation covers percent-encoded database URLs.
• Auth, owner isolation, and the first proof workflow are exercised end-to-end.
• Restart/recovery and cleanup behavior are tested without orphaned jobs or data corruption.
• Backup/restore and retention expectations for sealed snapshots are documented and tested when the snapshot path is live.
• A self-hosted runbook lists required environment variables, security boundaries, and unsupported deployment modes.

Priority

P1 - High · Phase 0 release-readiness gate.

Dependencies

Coordinate with #93, #95, #109, and #110. This issue verifies the integrated deployable system; it should not duplicate their implementation details.