ops: harden Coolify production configuration

[vib-tools]

Summary

Applies YGIT deployment configuration contract 1.0.0 and hardens the Coolify production redeploy configuration.

Source

• Head branch: ops/coolify-production-hardening-config-v1
• Base branch: main
• Head commit: a501ac28c821f461505294ce298d5527a9c0553a
• Expected base commit: f11dc84342fb4ad99ac6ab1dd56c11a8eaed884d

Approved scope

Exactly 11 files:

• .env.example
• CONTRACT_MANIFEST.json
• LIVE_DEPLOYMENT_RUNBOOK.md
• VERSION.json
• backend/tests/test_coolify_production_configuration.py
• backend/tests/test_live_readiness.py
• backend/tests/test_runtime_image_packaging.py
• docker-compose.yml
• docs/deployment/COOLIFY_PRODUCTION_REDEPLOY_CONFIGURATION_SPECIFICATION.md
• scripts/live_readiness.py
• scripts/release_gate.py

Validation completed before PR

• Python 3.12 compilation: PASS
• Changed-file Ruff checks: PASS
• Focused tests: 41 passed
• Full test suite: 598 passed, one non-blocking dependency deprecation warning
• Smoke test with database skipped: PASS
• Release gate with database skipped: PASS
• Docker Compose positive configuration validation: PASS
• Missing POSTGRES_USER: fail-closed PASS
• Missing POSTGRES_PASSWORD: fail-closed PASS
• Missing POSTGRES_DB: fail-closed PASS
• Commit parent and exact one-commit distance: PASS
• Exact 11-file committed scope: PASS
• Working tree clean: PASS
• Canonical patch ZIP inventory and per-entry content hashes: PASS

Safety boundaries

• Provider execution remains disabled for the first controlled redeploy.
• Existing PostgreSQL and Redis volumes are preserved.
• No provider calls were executed.
• No Coolify settings were changed.
• No deployment or redeployment was performed.
• Merge requires separate explicit authorization.
• Coolify configuration and redeployment require separate explicit authorizations.