Add governed orthophoto release promotion

docs/API_CONTRACTS.md

@@ -476,6 +476,17 @@ containment, sampled flight dates/years, local comparison state and
 `staging_permitted`. It performs no pixel request, upload, Job, Dataset write
 or legacy metadata rewrite. This operator script adds no public API contract.
 
+Governed pixel promotion remains outside the HTTP request cycle in
+`scripts/manage_orthophoto_release.py`. `plan` reruns that read-only preflight;
+`stage` makes exactly one allowlisted bounded `Ortho` GetMap request and writes
+only checksummed source/raster/preview evidence; `review` requires a named
+approval; and `apply` requires the exact plan/review SHA-256 values. Apply
+revalidates the remote identity and local comparison state, then delegates to
+the existing `POST .../datasets/upload` contract with `dataset_type=raster`,
+`source_name=digitaal_vlaanderen_orthophoto`, the official `YYYY.NN`
+`source_version` and complete source/provenance metadata. No release endpoint,
+provider URL parameter, Job type or alternate response envelope is added.
+
 The endpoint accepts no arbitrary URL, feature query, area or layer. It does
 not fetch vector features, raster pixels or models, create jobs/datasets, write
 to PostGIS or trigger an import. The normal `source-freshness` endpoint remains