[P2][Deferred][Release] same-origin staging canaryからproduction releaseへ安全にpromotionする

[Hosi121]

Parent / dependency

• Parent: [P2][Deferred][Epic][SaaS] Studioをmulti-tenant SaaS実行基盤へ移行する #116
• Blocked by: [P2][Deferred][Canary] same-origin stagingでaccount・billing・collaboration・exportを統合証明する #372（same-origin staging canary）
• Blocked by: [P2][Deferred][Infra] production PostgreSQL・Hyperdrive・PITR authorityを構築する #484（production PostgreSQL / Hyperdrive / PITR）

Problem

#372はprivate same-origin staging canaryで終わり、production traffic promotionをnon-goalとしている。production custom-domain routing、secrets/data authorities、capacity/alerts、rollout/rollback、commercial launch modeを所有する最終gateが必要である。

Goal

one reviewed canary artifact setを、evidenceとtraffic enablementの間でcode/trust identityを変えずにbounded production releaseへpromoteする。

Scope

• production domain/routes/TLS and same-origin boundary
• production PostgreSQL/Hyperdrive、private R2、Node/Workers、engine ABI/WASM・client-export verifier identity
• invite-only beta vs self-service launch decision
• Stripe test-to-live decisionとexplicit paid-feature gate
• capacity/admission limits、privacy-safe SLO/alerts、incident response、rollback、data recovery
• canary tenant → limited tenants → general availability stages

Acceptance criteria

• every production componentが同一reviewed release manifestとexact migration headから導出される
• custom-domain routesがworkers.dev、preview、direct bucket、broker/internal originを公開しない
• production secretsが独立provision/rotate可能でsource/log/artifact/client bundleに存在しない
• browser exportとserver verifierが同じcanonical Rust contract・engine ABI・export profileを使用する
• production account/billing/collaboration/source/editor/export/artifact flowが[P2][Deferred][Canary] same-origin stagingでaccount・billing・collaboration・exportを統合証明する #372 invariantsを再現する
• production SaaS経路でuser Python、legacy host spawn、Runtime Trace sandboxを有効化しない
• launch modeを明示し、invite-onlyならpublic self-signupを必須にしない
• paid accessはlive Stripe review/evidenceなしに有効化しない
• bounded non-sensitive metricsでcapacity/queue/error/auth/billing/storage/export-admission driftを監視する
• rollout stop conditionとroute/version rollbackを実証する
• backup restore、kill switch、credential revocation、orphan cleanup runbookにownerがいる
• post-promotion auditでcross-tenant/public object/raw code/path/credential/payment leakageがない

Non-goals

• unreviewed rolling contract/migration changes
• initial releaseでのglobal multi-region scheduling
• invite-only betaにpublic self-signupを必須化すること