[jmgasper]

Promote develop to master for the production rollout of forums-api-v6. This includes the deployment migration and the application/security fixes listed below.

The workflow uses the scoped CircleCI OIDC deployment role, immutable image releases, image scanning, and ECS health verification. Production deployment requires the approve-prod CircleCI approval. Deployment roles cannot read Parameter Store or secret values.

Included changes:

• Adopt tc-core-library-js v4 shared authentication and bus clients
• fix: patch dependencies and pin secure container inputs
• chore: adopt core v4.0.0-rc.2 identity denylists
• Prepare forums-api-v6 develop deployment with OIDC v2.0.5

Release readiness (verified 2026-11-05):

• Production OIDC role and permission boundary, restricted context, immutable ECR repository, and service/adapter preflight verified. Deployment roles explicitly deny Parameter Store and secret reads.
• Production workflow requires approve-prod. Health-check bootstrap is either installed or supported by the reviewed release adapter.
• The reviewed development commit is running on stable ECS tasks; running image tags match the source commit.

Remaining release gates:

• Complete operator dev validation, required GitHub checks/reviews, and CircleCI production approval.

Production readiness records and promotion index: private infrastructure repository.