[codex] 记录 WebChat 退役生产部署

[greenthree]

What changed

• Record the approved production deployment of 202608090001_retire_webchat_mutations.sql.
• Record the webchat-config v14 deployment and the resulting closed-state verification.
• Update ROADMAP.md from 75 to 76 production migrations and remove stale "pending deployment" wording.
• Record the current-main Schema v2 encrypted backup and isolated restore drill.
• Mark the Schema v2 restore item complete in the release checklist and record the next PAT renewal date.

Production scope

• Only the approved migration and webchat-config were deployed.
• The repository-level SUPABASE_ACCESS_TOKEN was rotated after two fail-closed backup runs returned Unauthorized; the replacement token was entered directly by the project owner and its value was not read or recorded by the Agent.
• No Supabase Function Secret/Vault changes, other Edge Function deployments, Pages deployment, model request, image request, or WebChat message request.
• Database rollback remains forward-only via corrective migration.

Validation

• Migration list: 76 local/remote migrations, 0 pending.
• Strict Supabase readiness: passed.
• webchat-config tests: 15 passed, 0 failed.
• Database read-only reconciliation: relay requests disabled, image uploads paused, all six retired writers revoked for anon, authenticated, and service_role, and zero post-deploy request/usage increments.
• Chrome production checks: desktop, 390px, and 1440px home page layouts; no console warnings/errors; ordinary users have no AI entry point.
• Encrypted backup run 31622577243: passed, including Schema v2 Storage snapshot, encryption self-check, plaintext cleanup, and Artifact upload.
• Isolated restore run 31622919641: passed with 76 migrations, 8 aggregate row counts, 7 orphan counts at zero, private Storage and anonymous-denial verification, Auth hooks, password login, RLS, fenced deletion, canary cleanup, and decrypted-file cleanup.
• Documentation formatting, git diff --check, and secret-like pattern scan passed.

The full production-security script was intentionally not run because it temporarily enables image upload and uploads a fixture, which was outside the approved no-image-request scope.

The replacement Supabase PAT expires on 2026-09-12 and must be rotated before expiry, followed by a successful backup confirmation.