Pre-launch hardening and release readiness

## Source reviews

- #570
- #571
- Product feedback: #571 (issue comment dated 2026-07-16)

## Goal

Complete the security, reliability, release, and operational work required for a safe public launch of Promise Tracker.

This is the coordinating issue. The implementation work is tracked in its native GitHub sub-issues and should be completed in dependency order.

## Product decisions

- Editorial users are intentionally allowed to work across the entire site. Tenant-scoped user membership is not required for launch.
- Privileged administration remains separate: ordinary editors must not manage users or retrieve/change platform credentials.
- Public entity pages are universal. Political-entity slugs must therefore be enforced as globally unique, or all lookups must use an unambiguous resolved entity identifier.
- Published public content remains public. Draft content and internal processing metadata must not be anonymously enumerable.

## Launch gates

- [ ] Credentials and privileged administration are protected, and existing credentials are rotated.
- [ ] Anonymous REST and GraphQL access exposes only approved published data.
- [ ] CMS embeds and remote-file ingestion have safe trust boundaries.
- [ ] Tests use isolated databases and deployment is blocked unless verification passes.
- [ ] Production uses an approval-gated immutable-image release with a single-instance migration step.
- [ ] Liveness/readiness probes, backup restoration, and rollback are verified.
- [ ] Route/entity invariants and AI workflow limits are enforced.
- [ ] Staging passes critical-flow, security, accessibility, and load validation.

## Launch decision

Public launch is a no-go until every launch-blocking sub-issue is complete, the exact production image has passed staging, and rollback plus database restoration have been rehearsed.

## Acceptance criteria

- [ ] All native sub-issues are closed.
- [ ] The complete production pipeline passes for the immutable release artifact.
- [ ] Staging sign-off records the security, accessibility, load, backup-restore, and rollback results.
- [ ] Product and engineering explicitly approve the production launch.

## Blocked by

None - this is the coordinating parent issue.

Start with the native sub-issues listed under #570 and #571, then review their dependency order and launch gates. Done means all native sub-issues are closed, the immutable production pipeline passes staging, sign-off covers security, accessibility, load, backup restoration, and rollback, and product and engineering approve the launch.

Written by the indexing model from the issue text.