Harden first public release path

[maincarry]

Summary

• add a staged Terraform evaluation path with one-target canary gates, account/Region/CIDR enforcement, public-egress validation, architecture-locked images, and an AWS-only emergency pause
• bound and recover runtime work with namespace-scoped scanner quotas, per-destination serialization, generator claim recovery, DLQ redrive, and durable DynamoDB outbox replay
• strengthen release confidence with hermetic migrator packaging, PostgreSQL/envtest/Terraform/Kubernetes/container gates, and end-to-end setup and finding-integration documentation

Test plan

• make KUBECONFORM='go run github.com/yannh/kubeconform/cmd/kubeconform@v0.8.0' HELM='go run helm.sh/helm/v3/cmd/helm@v3.20.1' ci
• uvx pre-commit run --all-files
• git diff --check

Validation boundary

• No AWS resources were created and no live network scan was performed.

Made with Cursor