BUILD-020: controlled production cutover for MSH OS

Release certification without host access is paperwork. BUILD-020 was the real cutover: pre-deploy Postgres dump, twenty-three migrations, new images, Redis, and worker with outbox scheduler.

We fixed a worker path-alias bug in hypercare when jobs could not resolve @/db — a reminder that background processes need the same module resolution as the web app.

Live checks: /api/health ok, /api/ready with database, migrations, redis, storage. Email deliberately unconfigured until DKIM ships.