fix: address promotion review findings

[BeforeLights]

Summary

• address valid CodeRabbit safety/correctness findings from promotion PR promote: foundation batch and platform gates #20
• harden local Compose exposure, Docker lifecycle probes, persistence cleanup, and environment loading
• normalize hostile telemetry reflection/provider failures
• strengthen AWS policy/Fargate validation and parse CI workflows structurally
• add artifact-content assertions and reconcile evidence/runbooks

Verification

• corepack pnpm format:check
• corepack pnpm lint
• corepack pnpm typecheck
• corepack pnpm test
• corepack pnpm repo:build
• uv run --locked ruff check src tests
• uv run --locked ruff format --check src tests
• uv run --locked mypy src
• ./gradlew.bat :app:testDebugUnitTest --offline --no-daemon

This is a focused promotion-gate fix PR; the normal 30+ commit feature batching rule is intentionally not applied. No CodeRabbit review is requested here; PR #20 remains the single reviewed promotion PR.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 639375b3-165e-4709-b2e3-896cf9ec5fd6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}