Production beta vertical slice and integration proof

[anaschatz]

Scope freeze

This PR is the production-beta vertical slice. Merge preparation added only
documentation consistency, release metadata and the render.yaml deployment
branch correction. It did not change video output, FFmpeg arguments, ranking,
HookGate policies, providers or applied migration contents.

Implemented

• async web/worker/migrate composition root
• PostgreSQL repositories, scoped idempotency and checksummed migrations
• PostgreSQL SKIP LOCKED queue, fenced leases, retries, cancellation and DLQ
• OIDC Authorization Code + PKCE sessions, CSRF and owner isolation
• S3/R2 multipart artifacts, validation, cleanup and session-bound delivery
• editorially distinct football candidates, bounded previews and atomic approval/render enqueue
• bounded observability plus durable usage and cost events
• one web service and two independent workers in render.yaml

Evidence for head 099015ff63504e40b764c820891eda46e06327dd

Local clean-checkout verification:

• npm ci: passed with locked dependencies
• npm run lint: passed
• npm run build: passed
• npm test: 1,690 tests; 1,683 passed; 7 explicit external/opt-in skips; 0 failed
• python -m unittest discover -s tests -v: 501 passed
• python scripts/run_python_tests_isolated.py: 51/51 modules passed
• python research/eval.py: 96.2981; hard guardrails passed
• README relative links/assets: all present

The exact-SHA GitHub Release gate, Python isolation/HookGate and disposable
PostgreSQL/S3 multi-worker jobs must all complete successfully before merge.

Security and dependency review

• exact-history gitleaks scanning is part of the GitHub workflows
• .env.example contains placeholders/empty secret values only
• production composition fails closed unless PostgreSQL queue/persistence, R2,
  OIDC and durable PostgreSQL telemetry are selected
• local/development authentication is rejected by the strict production root
• npm audit reports 0 high, 0 critical and 3 moderate findings from the
  transitive HyperFrames/Hono static-server chain; the affected Windows static
  path is not exposed by the Linux production runtime. Upgrading HyperFrames may
  change rendering behavior and is intentionally deferred to a separate tested PR.

.gitleaksignore retains commit-bound fingerprints only for synthetic strings in
existing history. A merge commit preserves those object IDs; no new allowlist was
added.

Migration compatibility

The canonical greenfield chain is 0001_identity_sessions_audit.sql through
0007_production_controls_telemetry.sql. Fresh migration, rerun, concurrent lock,
rollback and checksum mismatch behavior are tested.

The former 0001_production_beta.sql prototype is not an upgrade base for the new
chain. GitHub deployment records show no staging deployment after that legacy file
entered main. If any manually managed external database contains that legacy
migration, deployment must stop and use a reviewed additive migration strategy;
the database must not be reset or destructively modified.

Readiness boundary

Status: production beta — integration-proven, external staging pending.

This PR does not claim fully production-ready. Real managed PostgreSQL/R2, an
external OIDC provider, two deployed workers, restart/lease recovery, Range
delivery and durable telemetry still require protected exact-commit staging proof.

Rollback

If post-merge verification fails, stop new worker claims and redeploy the previous
main commit. Revert the merge with a normal revert commit; do not rewrite history
and do not roll back or delete PostgreSQL data destructively. Keep unpublished R2
artifacts private and run the existing reconciliation/cleanup path after the
application rollback.