Ship roadmap hardening: deploy preflight, exports persistence, content gates

[AlexU-A]

Summary

This PR bundles the remaining roadmap execution work into OSS and aligns deployment, exports persistence, content readiness gates, governance docs, and security scanning.

Included Changes

• CI/deploy preflight hardening
  • Added staging preflight gate execution script and wired deploy workflow to run preflight before image build/push.
  • Ensures staging run checks the pushed SHA.
• Exports persistence migration and async service/router alignment
  • Added export_jobs migration artifacts and DB-backed export service behavior.
  • Updated router handlers to await async export service calls.
  • Added focused export service test coverage.
• Content infrastructure production-readiness hardening
  • Added runtime provider wiring and fail-closed readiness checks.
  • Added HTTP-backed generation provider and voice analyzer adapters.
  • Exposed provider wiring in health and expanded generation metrics.
  • Added integration tests for provider readiness behavior.
• Deploy artifacts for EC2/prod compose
  • Added deploy.sh, setup-ec2.sh, production compose overrides, and staging runbook.
• Governance/documentation sync
  • Constitution sync updates and legacy spec checklist/section alignment for governance checks.
• Security scanning config
  • Added/updated .gitleaks.toml allowlist entries for known fixture/transcript false positives.

Commits

• aa0494d ci: harden staging preflight deploy gate
• 3b98230 test(exports): add db-backed export migration coverage
• f3a9c03 feat(exports): switch export service to persisted db jobs
• be8954b feat(content): enforce real provider readiness gates
• c0a646e chore(deploy): add prod compose and ec2 runbook scripts
• e53c740 docs(governance): align constitution and legacy spec checklists
• 84a5230 chore(security): add gitleaks allowlist for known fixtures

Validation

• python3 scripts/spec-governance-check.py --strict (pass)
• gitleaks git --no-banner --redact (pass)
• Export tests (pass in source workspace before cherry-pick):
  • npm test -- --run tests/exports.test.ts tests/exports/service.test.ts
• Content readiness tests (pass in source workspace before cherry-pick):
  • npm run -s typecheck
  • npm test -- --run tests/content/integration/production-provider.test.ts tests/content/integration/*.test.ts

Notes

• This repository enforces PR-only updates to main; this branch is intended for review + required checks.

[AlexU-A]

Closing as superseded by PR #2 and PR #3 with updated CI/governance fixes and scoped feature work.