Add rollout readiness gate and audit

[folker]

What changed

• adds a dated rollout-readiness review with blockers, follow-up issues, and a release gate
• adds tools/rollout_readiness.py, which fails closed while production configuration, human media approval, administrator acceptance, or deployment are incomplete
• adds browser-native WebVTT caption tracks to all 15 course videos while retaining downloadable SRT captions
• makes site_status: staging block production builds
• expands the administrator checklist for deployment, media hosting, browser captions, artifact synchronization, and rollout messaging
• synchronizes the canonical Part 4 source with the rootless Apptainer explanation
• corrects stale README statements about Classes 5–15 media sources

Review result

The curriculum is structurally mature and suitable for a controlled pilot, but it is not ready for production publication. Remaining blockers are primarily institutional and operational:

1. staging status and seven unresolved production configuration values
2. unpublished MP4 media and no final human video approval
3. 65 unchecked administrator, platform, privacy, domain, and accessibility acceptance items
4. no reviewed production deployment/rollback workflow
5. unresolved final user journey around the unlisted rollout page and RCC Connect wording

Validation

• repository validation: 76 documentation tests and 6 protected-app tests pass
• custom site build and internal link check pass
• all 15 rendered course pages include valid WebVTT caption tracks
• production build fails closed on unresolved configuration as intended
• rollout readiness audit reports five blocker groups as intended
• sampled UME, Coscine, remote-console, and secure-tunnel external links returned HTTP 200; official EU/German legal endpoints timed out from this environment and remain a clean-client launch check