[jmgasper]

Promote develop to master for the production rollout of forms-processor-v6. This includes the deployment migration and the application/security fixes listed below.

The workflow uses the scoped CircleCI OIDC deployment role, immutable image releases, image scanning, and ECS health verification. Production deployment requires the approve-prod CircleCI approval. Deployment roles cannot read Parameter Store or secret values.

Included changes:

• Adopt tc-core-library-js v4 shared authentication and bus clients
• PM-6687 - Sales lead: send all recipients as "replyTo"
• Patch Forms processor dependencies and production image
• PM-6686 - space tech emails
• chore: adopt core v4.0.0-rc.2 identity denylists
• Prepare forms-processor-v6 develop deployment with OIDC v2.0.5

Related Jira tickets included in the development history:

• PM-6686
• PM-6687

Release readiness (verified 2026-11-05):

• Production OIDC role and permission boundary, restricted context, immutable ECR repository, and service/adapter preflight verified. Deployment roles explicitly deny Parameter Store and secret reads.
• Production workflow requires approve-prod. Health-check bootstrap is either installed or supported by the reviewed release adapter.
• The reviewed development commit is running on stable ECS tasks; running image tags match the source commit.

Remaining release gates:

• Strict production scan gate: dev digest has 0 critical, 0 high, 1 medium active findings. Resolve and rescan before release; no production exception is approved.
• Complete operator dev validation, required GitHub checks/reviews, and CircleCI production approval.

Production readiness records and promotion index: private infrastructure repository.

Follow-up check (2026-11-05T01:35:03.719126+00:00): all reconciliation/packaging follow-ups are merged. Latest dev source is running on stable, healthy ECS tasks.