WEB-002D: repause Netlify release authority

[daliu]

Refs #659

Officer impact: Immediately restores the fail-closed Netlify release pause after the reviewed WEB-002D artifact was published. The already published website remains unchanged; this control-only change prevents the one-use release manifest from authorizing another production build.

Officer documentation: None — the active release documentation remains the reviewed pending/source record, and final live truth will be recorded in a separate post-publication change after this repause is merged and verified. This PR changes only the machine-enforced manifest, its Netlify comment, and mutation-sensitive release tests.

Deployment evidence: Production deploy 6a7ece87c5ca4d0007c1a3fc is ready and published for exact release merge 46e23647d8e0bf9fa3a574ea5c5f993be10a419d; exact-main CI run 31783141914 passed all five jobs. The live marker binds release WEB-002D-KEYBOARD-FOCUS-2026-08-14, issue 659, control 46e23647..., source 7496fe0881fb52908c4ff2f40f488df09c94c908, tree ccac4c189c195db8ab594e0eefe256ea9fa04996, previous source c2d87d1f..., rollback deploy 6a7e072f8f346b0008510d29, 62 files, and digest e4c26e6f0fbcd086663d86238675f0be228fb649a00628c1c97d1166612f49c7. Netlify reports no Functions and no edge functions. Signed-out desktop 1280×900 and phone 390×844 checks confirmed route focus, deterministic phone-menu closure, top scroll position, and no horizontal overflow. Repause exact-head CI run 31783487885 passed all five jobs. Netlify Deploy Preview 6a7ecfbc90347c000804901c is ready at exact head 94c949abed3759c15cdaa98afc6896343e8a6edd, review 661, context deploy-preview, and published_at:null; provider metadata again reports no Functions and no edge functions. PR #661 merged as exact two-parent commit 3138a00c1c48e1d5d1dcda0b44722b09a2194ff7, tree c4667394dc9a2286c3a2eda028728314e925c22f; exact-main CI run 31783808994 passed all five jobs. Netlify production attempt 6a7ed0ddb00a46000818878d ended in error with published_at:null, while the published deploy, marker, all 62 artifact files, and digest remained unchanged. Temporary source/control/repause refs are retired; the rollback ref remains pinned to c2d87d1f.... Firebase, Rules, Functions, indexes, providers, accounts/sign-in, production data, payments, DNS, and connected directory behavior were not changed. Final live-truth documentation remains pending.

Exact repause

• Head 94c949abed3759c15cdaa98afc6896343e8a6edd
• Tree c4667394dc9a2286c3a2eda028728314e925c22f
• Sole parent 137d8a8721339a6ca1079283cc34c1bd7cc2706c, whose tree equals release merge 46e23647...
• Required merge first parent 46e23647d8e0bf9fa3a574ea5c5f993be10a419d
• Exact three paths: config/netlify-production-release.json, netlify.toml, and tests/release-workflow.test.js
• Exact binary diff SHA-256 757f3c16a444d3c371c350a6a109aff24f3f166c9bbb56c2c45e8eb9bd05ad2c
• Manifest changes only active:true to active:false; the Netlify comment and exact tests change to the inactive expectation.

Verification

• Release workflow: 14/14 pass
• Root release/security/SPA subset: 105/105 pass
• Production ignore gate pauses on exact Netlify production identity
• Local pinned release builder refuses while inactive
• Frozen source and rollback refs remain present and exact
• Documentation is byte-identical to the reviewed active release
• Protected OAUTH-001A2L — Bound Strava activity/statistics JSON and cancel the unread statistics body #616 blobs/hunk and literal-false directory availability are unchanged
• git diff --check passes

Merge gate

Merge only with a GitHub merge commit after exact-head CI and Netlify checks are terminal, remote main remains exact release merge 46e23647..., the PR diff remains exactly three paths and the stated digest, and production still points to deploy 6a7ece87c5ca4d0007c1a3fc. After merge, require a two-parent commit with first parent 46e23647... and second parent 94c949a...; its Netlify production attempt must remain unpublished while the published site and marker remain byte-identical. Never squash, rebase, promote a preview, invoke a build hook or netlify deploy --prod, or dispatch the Firebase/GitHub Pages workflow.

[netlify]

✅ Deploy Preview for luminous-fox-7c393f ready!

Name	Link
🔨 Latest commit	94c949a
🔍 Latest deploy log	https://app.netlify.com/projects/luminous-fox-7c393f/deploys/6a7ecfbc90347c000804901c
😎 Deploy Preview	https://deploy-preview-661--luminous-fox-7c393f.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.