[jmgasper]

Promote develop to master for the production rollout of timeline-wall-api. This includes the deployment migration and the application/security fixes listed below.

The workflow uses the scoped CircleCI OIDC deployment role, immutable image releases, image scanning, and ECS health verification. Production deployment requires the approve-prod CircleCI approval. Deployment roles cannot read Parameter Store or secret values.

Included changes:

• fix: remediate Timeline runtime and dependency vulnerabilities
• chore: adopt core v4.0.0-rc.2 identity denylists
• Prepare timeline-wall-api develop deployment with OIDC v2.0.5
• Restore deployed route prefix and runtime environment compatibility

Release readiness (verified 2026-11-05):

• Production OIDC role and permission boundary, restricted context, immutable ECR repository, and service/adapter preflight verified. Deployment roles explicitly deny Parameter Store and secret reads.
• Production workflow requires approve-prod. Health-check bootstrap is either installed or supported by the reviewed release adapter.
• The reviewed development commit is running on stable ECS tasks; running image tags match the source commit.

Remaining release gates:

• Strict production scan gate: dev digest has 0 critical, 0 high, 1 medium active findings. Resolve and rescan before release; no production exception is approved.
• Complete operator dev validation, required GitHub checks/reviews, and CircleCI production approval.

Production readiness records and promotion index: private infrastructure repository.