[jmgasper]

Promote develop to master for the production rollout of learning-paths-api. This includes the deployment migration and the application/security fixes listed below.

The workflow uses the scoped CircleCI OIDC deployment role, immutable image releases, image scanning, and ECS health verification. Production deployment requires the approve-prod CircleCI approval. Deployment roles cannot read Parameter Store or secret values.

Included changes:

• Harden dependencies and container security
• License and Trivy updates
• Resolve remaining Dependabot and code scanning alerts
• fix: remediate Learning Paths runtime and utility vulnerabilities
• chore: adopt core v4.0.0-rc.2 identity denylists
• Prepare learning-paths-api develop deployment with OIDC v2.0.5

Release readiness (verified 2026-11-05):

• Production OIDC role and permission boundary, restricted context, immutable ECR repository, and service/adapter preflight verified. Deployment roles explicitly deny Parameter Store and secret reads.
• Production workflow requires approve-prod. Health-check bootstrap is either installed or supported by the reviewed release adapter.
• The reviewed development commit is running on stable ECS tasks; running image tags match the source commit.

Remaining release gates:

• Complete operator dev validation, required GitHub checks/reviews, and CircleCI production approval.

Production readiness records and promotion index: private infrastructure repository.