Implement protected private CI release and state recovery

[zmuhls]

The historical staging workflow cannot reach the private host and deploys a mutable checkout through a password/sudo command. This change implements a protected manual CI release of the exact successful current-main SHA through pinned Tailscale access and verified SSH host keys. It is stacked on #15. The protected fleet release has not been run.

The source guard rejects stale SHAs, PR-only or failed/pending CI, and an environment that is not restricted to main. The host verifies an immutable archive, installs frozen dependencies with an ephemeral read token, and builds before stopping writers. It verifies the existing API's actual database/uploads, snapshots both, restores and migrates a disposable copy, then rechecks main before the live additive migration. PM2 recreates one loopback API/web pair and verifies private readiness at the exact SHA. Failure restores prior process definitions without restoring live data. Account linking and local roles are unchanged.

Both workflow runs at 51852bdc27dc9d4ab3acc156d2d8fb3fc8c46804 report successful completion:

• Test and build: frontend types, both builds, 724 application tests, eight shell suites and mounted browser acceptance. The eight actual-Gateway cases retain their explicit opt-in boundary.
• Release safeguards: source and activation safeguards, including real isolated PM2/TypeScript replacement and recovery on Linux.
• SQLite/WAL plus upload snapshot, hash verification and new-destination restoration checks pass. The new commit adds host evidence and updates the runbook; application and release code are unchanged from 7e5275a.

GitHub readback is inconsistent for the safeguards job: its workflow and every step report success, while the individual check record still reports in_progress. This is not evidence of release eligibility; the exact-source release guard must observe completed successful jobs before any release.

The September 23 host audit now confirms administrative SSH access and real storage paths. It repaired a pre-existing native SQLite/Node ABI failure by pinning only the legacy API to a private Node 22.23.1 runtime. Loopback health and anonymous auth rejection pass, and other PM2 apps were unchanged. This was a repair to the existing service, not a deployment of the fleet receiver.

A real production-state backup and restoration verified all 78 files, including 77 uploads. The API recovered after a 4.33-second pause. The actual additive identity migration ran twice on the restored copy, preserving all original values across 16 tables, with every user still unlinked. The live source, identity schema and roles are unchanged. The original snapshot still verifies. The legacy public URL returned 403 from the host network, so public/campus browser access is not established by this receipt.

The GitHub production environment allows only branch main; no release secrets have been added. Remaining prerequisites are the scoped Tailscale OAuth connection, dedicated verified SSH key, private release configuration/directories, and pinned release toolchain. The shared host defaults remain Node 24.19.0, pnpm 10.33.0 and PM2 6.0.13 and must not be globally replaced. The existing API runtime repair does not satisfy the CI PATH contract by itself. Doorway-to-Node ingress, verified account associations and deployed CUNY/model/export acceptance remain separate requirements. No shared Gateway, Doorway or Admission change is included.