Cutover checklist (main-only + gated deploy) — human, once

Status after agent delivery (2026-07-31):

Code PR opened (main-only cutover) — see PR targeting main
pnpm configure:branch-protection applied on main (required: checks + migration-lock, strict=false, 0 reviews)
No open PRs targeting stage at cutover time
Repo secrets still needed:
- VERCEL_TOKEN, VERCEL_ORG_ID, VERCEL_PROJECT_ID (deploy job fail-closed until set)
- POOL_GITHUB_TOKEN (PAT: actions:write + issues:write + contents:read) — PROMOTE_GITHUB_TOKEN already exists; reuse/rename if scopes cover Actions variables, else mint a new PAT

After the cutover PR merges to main:

Validate Vercel Git skip: push to main must not start a Vercel Git build (ignoreCommand exit 0). Production comes only from ci.yml → deploy.
Confirm ci.yml runs full suite; deploy job runs or fails closed with a clear missing-secrets message until VERCEL_* are set.
POOL_GITHUB_TOKEN=… pnpm agent:pool -- doctor must read repo variables.
Optionally delete branch stage and its Environment/secrets when idle.