Add governed orthophoto release promotion

backend/README.md

@@ -1313,12 +1313,48 @@ docker exec geointel python /app/scripts/orthophoto_release_preflight.py \
 
 The command reads canonical API envelopes, exact official WMS capabilities,
 WCS `DescribeCoverage` and at most 64 queryable flight-day points. It never
-requests raster pixels or mutates application/storage state. Only
-`staging_permitted=true` may feed a future separate staging command. `current`,
-remote-older, mixed/incorrect flight years and legacy local values such as
-`most_recent_at_2026-07-15` remain non-stageable. The report's point grid is
-flight-date evidence; complete selected-area coverage comes from containment
-inside the official 15 cm WCS raster domain.
+requests raster pixels or mutates application/storage state. `current`,
+remote-older and mixed/incorrect flight years remain non-stageable. The
+report's point grid is flight-date evidence; complete selected-area coverage
+comes from containment inside the official 15 cm WCS raster domain.
+
+Official release promotion is a separate four-action operator workflow. Run it
+inside the all-in-one container so stage/apply can use only the loopback API:
+
+```bash
+# Read-only decision; copy the reported edition and current local marker.
+docker exec geointel python /app/scripts/manage_orthophoto_release.py plan \
+  --project-id 82a85913-c522-45d7-84a1-02b393d89e55 \
+  --bbox 5.110 51.180 5.117 51.185 --refresh-catalog
+
+# First official baseline only: both values must match the fresh preflight.
+docker exec geointel python /app/scripts/manage_orthophoto_release.py stage \
+  --project-id 82a85913-c522-45d7-84a1-02b393d89e55 \
+  --bbox 5.110 51.180 5.117 51.185 \
+  --confirm-edition 2025.04 \
+  --establish-official-baseline \
+  --confirm-local-version most_recent_at_2026-07-15
+
+# Inspect review-preview.png, then use the exact plan SHA printed by stage.
+docker exec geointel python /app/scripts/manage_orthophoto_release.py review \
+  --project-id 82a85913-c522-45d7-84a1-02b393d89e55 \
+  --bbox 5.110 51.180 5.117 51.185 \
+  --confirm-edition 2025.04 --confirm-plan-sha256 <plan-sha256> \
+  --approve --reviewer "<operator name>" --review-note "<bounded review>"
+
+# Apply only the exact approved bytes and hashes.
+docker exec geointel python /app/scripts/manage_orthophoto_release.py apply \
+  --project-id 82a85913-c522-45d7-84a1-02b393d89e55 \
+  --bbox 5.110 51.180 5.117 51.185 \
+  --confirm-edition 2025.04 --confirm-plan-sha256 <plan-sha256> \
+  --confirm-review-sha256 <review-sha256>
+```
+
+For a later comparable `YYYY.NN` update, omit the two first-baseline flags.
+Stage performs one bounded pixel request but no database mutation. Apply is
+idempotent for the exact plan/raster checksum, creates a new immutable raster
+Dataset and DatasetVersion with the official edition, and retains every older
+snapshot. No command is scheduled or invoked by startup or browser actions.
 
 ## Governed DHMV terrain acquisition