[U28] Produce the final non-root application image

[ZempTime]

PRD: #1
Delivery unit: U28
Campaign: C09
Canonical graph: https://github.com/ZempTime/shortbread/blob/246320c73d81e5afdf0490b43a2b02272f40268b/docs/initiatives/2026-07-shortbread-v1/05_delivery_replan/output/2026-07-20-delivery-plan.md
Common unit contract: https://github.com/ZempTime/shortbread/blob/246320c73d81e5afdf0490b43a2b02272f40268b/docs/initiatives/2026-07-shortbread-v1/05_delivery_replan/output/UNIT-CONTRACT.md

• Acceptance umbrella / blockers: GitHub Produce release-candidate application and CLI artifacts #12; blocked by U03, U19, U22, U24, U25, and U27.
• Outcome: CI/local tooling produces an immutable production application image that runs non-root with documented migrate/web/worker/WebSocket commands, health behavior, runtime configuration, and complete built assets.
• Failure/recovery: Missing config, migration failure, read-only filesystem assumptions, signal/shutdown, worker/WebSocket failure, architecture mismatch, and container vulnerabilities fail before release promotion.
• Evidence: Reproducible build, digest, container scan/SBOM-equivalent inventory, non-root/runtime health, production-shaped full journey smoke, and supply-chain/operations review.
• Central surfaces / impact: Container/release files, process commands, CI build, artifact naming. U30 publishes only after CLI artifacts also pass.
• Safe split: Image hardening and full product smoke may be two checkpoints, but one immutable digest must pass both before integration.

Every integration records a factory candidate with evidence or No reusable harvest.