Add governed orthophoto release promotion

docs/CODEX_EXECUTION_LOG.md

@@ -9767,3 +9767,35 @@ Boundary:
   backfill existing orthophotos. A future stage/review/apply coordinator must
   revalidate and retain the exact preflight identity before creating a new
   immutable raster Dataset with official `YYYY.NN` source version.
+
+## Sprint 231 - Governed orthophoto release promotion (2026-07-17)
+
+Implemented:
+- Added `scripts/manage_orthophoto_release.py` with separate `plan`, `stage`,
+  named `review` and checksum-confirmed `apply` actions for one bounded current
+  orthophoto selection. No action is scheduled or browser-triggered.
+- Reused the complete Sprint 230 preflight identity. Stage performs exactly one
+  allowlisted WMS `Ortho` GetMap, retains the exact source response, creates a
+  three-band EPSG:31370 GeoTIFF plus PNG preview and mutates no Dataset.
+- Bound remote catalog/WMS/WCS/flight evidence, request identity, all staged
+  file hashes, reviewer and the final Dataset checksum into atomic persistent
+  evidence. Host/path drift, oversize responses, modified bytes, stale local
+  state and missing exact confirmations fail closed.
+- Added a double-confirmed first official baseline transition for legacy
+  `most_recent_at_*` markers. Apply retains every legacy raster and uses only
+  the existing canonical upload/DatasetService transaction.
+- Made the latest official `YYYY.NN` Dataset authoritative for source-catalog
+  comparison even when a newer-imported rolling marker also exists. No API,
+  migration, release table, Job type or frontend behavior changed.
+
+Validation so far:
+- 38 focused Sprint 222/230/231 tests pass with deprecations treated as errors.
+  Coverage includes official-edition ordering, first-baseline authorization,
+  GetMap allowlisting/limits, RGB/CRS normalization, preview generation,
+  tampering, preflight drift, named review, loopback-only apply and complete
+  upload provenance.
+
+Next:
+- Run complete readiness, deploy the packaged operator to Tower, inspect the
+  live bounded Mol review preview and only then apply the first official
+  `2025.04` immutable baseline with explicit review evidence.