[jmgasper]

Platform UI currently uses the legacy shared Auth0/AWS deployment path and reads Parameter Store during CI. This change builds and publishes through project- and branch-bound CircleCI OIDC, with automatic dev deployment and a required approve-prod gate before production publication.

• Pin tc-deploy-scripts v2.0.8 by commit, Node 22.23.4 by image digest, and the AWS executor by image digest. The static-site adapter uses the shared authentication/process helpers; it does not run the ECS deploy command.
• Separate the read-only browser-config role from the S3/CloudFront publisher. Build configuration is allowlisted and pinned to an exact S3 version and SHA-256; the application build receives no AWS credentials. Both identities deny Parameter Store, Secrets Manager, KMS decryption, role chaining, and object deletion.
• Verify source and artifact hashes, upload assets before entry points, retain old assets, preserve /gigs/index.html, and verify public HTML after CloudFront invalidation. Failed promotion attempts restore the previous entry points. S3 versioning is enabled for recovery.
• Select production CMS/media origins for production builds; dev retains dev origins.

The dev/prod IAM stacks, permissions boundaries, empty restricted contexts, and versioned browser configuration are installed and verified. IAM definitions and setup receipts are kept in the private v6-services-iac repository. No site assets have been published during preparation.

Rollout: merge this PR to dev, then validate the resulting deployment and login/CMS/Gigs behavior. There is currently no prod branch: after dev validation, establish it from the reviewed master production baseline and open dev → prod. The new workflow requires approve-prod; it replaces the old master/QA/arbitrary-branch/tag deployment paths once promoted. The old workflow remains on master until that transition, so merging this PR to dev alone does not retire it. See deploy/README.md for the transition and recovery procedure.

Validation: locked dependency installation, repository lint, nine focused application tests, nine deployment boundary/rollback tests, CircleCI config validation, and 32 live IAM permission simulations passed. The full dev release build passed in the pinned Node container with a 16 GB memory limit. CircleCI pipeline 7231 also passed its validation job.

Existing dependency security alerts remain open, including three critical Storybook development-dependency alerts. This PR preserves the existing Trivy workflow and adds prod coverage; it does not claim dependency security clearance or change its severity policy.