fix(release): make deployment backup and rollback immutable

docs/CI_SUPPLY_CHAIN.md

@@ -5,8 +5,10 @@ GeoIntel uses the same release gates in Gitea Actions and GitHub Actions:
 - `.gitea/workflows/release-gates.yml`
 - `.github/workflows/release-gates.yml`
 
-Gitea is the operational source-control platform. The GitHub workflow is kept
-equivalent so a mirror or external review does not receive a weaker gate.
+Gitea is the operational source-control platform. Its release workflow builds
+the production AI variant and is the only workflow that can automatically
+deploy. The GitHub mirror builds and scans the same AI variant for external
+review but is not a production deployment authority.
 
 ## Runner requirements
 
@@ -16,11 +18,11 @@ The `ubuntu-latest` runner must provide:
 - Python 3.11 and Node 20 through the official setup actions;
 - Bash and Docker with Compose v2;
 - permission to build images and mount `/var/run/docker.sock`;
-- sufficient disk for the all-in-one GIS image and scanner databases.
+- sufficient disk for the all-in-one AI image and scanner databases.
 
-The container job builds the GIS release variant only. PyTorch and
-Ultralytics remain in the optional `ai` extra and in the explicit AI image
-variant; CI does not silently make them base dependencies.
+Both container jobs build the explicit AI image, including the
+PyTorch/Ultralytics layers used on Tower. AI packages remain outside the
+standard backend lock and are pinned by Docker build arguments.
 
 ## Quality gate
 
@@ -33,11 +35,25 @@ cd frontend && npm ci
 ```
 
 It then validates the lock policy and runs the complete readiness script. The
-readiness script covers backend compile/tests, contract audits, Alembic
-single-head, frontend typecheck/build and release-script syntax. CI also
+readiness script covers Ruff, repository-layout validation, backend
+compile/tests, contract audits, Alembic single-head, frontend typecheck/build
+and release-script syntax. CI also
 renders offline migration SQL and resolved Compose configuration as retained
 evidence.
 
+Pull requests run managed validation against the real `backend/` and
+`frontend/` projects plus the complete release gates. On a `main` push, the
+Unraid deploy job has explicit `needs` dependencies on quality, dependency and
+AI-container jobs. There is no separate deployment workflow: manual validation
+uses `workflow_dispatch` on this same release-gates workflow and cannot skip
+quality, dependency or AI-container jobs.
+
+The deploy host requires a full controller commit SHA, builds the AI variant,
+records its Docker image/config digest, generates SBOM and Trivy evidence for
+that exact local image, and starts the immutable image ID. Deployment fails if
+the running container ID, revision label or AI label differs from the retained
+attestation.
+
 ## Reproducible Python lock
 
 `backend/requirements-runtime.lock` and `backend/requirements-ci.lock` are
@@ -73,12 +89,12 @@ The dependency job:
 - publishes both unfiltered and policy-filtered Python JSON reports plus the
   npm JSON report, including on failure.
 
-The only current Python/container exceptions are the Starlette 2026 advisories recorded
-in `security/pip-audit-exceptions.json`. FastAPI 0.139.2 still constrains
-Starlette below 0.53 while patched releases begin at 1.x. GeoIntel applies
-request-target, form-content, route-class and Linux-runtime compensating
-controls. The exception file has a mandatory review date; readiness and CI
-fail automatically after it expires. New advisories are never auto-ignored.
+There are currently no Python or container vulnerability exceptions.
+`security/pip-audit-exceptions.json` remains as a strict, machine-readable
+registry: every future exception must identify one advisory, package, specific
+reason and expiry date. Readiness and CI fail on malformed or expired entries;
+new advisories are never auto-ignored. GeoIntel requires Starlette 1.3.1 or
+newer and therefore no longer suppresses the five 2026 Starlette advisories.
 The all-in-one image replaces the Go-based base-image `gosu` helper with a
 small `setpriv` exec wrapper and upgrades packaged setuptools/wheel metadata;
 the final runtime filesystem no longer exposes the vulnerable Go executable.
@@ -89,8 +105,8 @@ verified to contain the audited shell wrapper. This is not a vulnerability
 exception: the raw evidence remains published and the runtime wrapper is
 exercised during live release validation.
 
-The container job builds a non-AI all-in-one image and uses digest-pinned
-scanner images:
+The operational container job builds the production AI all-in-one image and
+uses digest-pinned scanner images:
 
 - Syft 1.44.0 generates an SPDX JSON SBOM;
 - Trivy 0.70.0 generates a complete JSON vulnerability report;
@@ -103,12 +119,12 @@ Run these controls on a Docker-enabled workstation:
 ```bash
 docker build \
   -f deploy/unraid/Dockerfile.all-in-one \
-  --build-arg GEOINTEL_INSTALL_AI=false \
+  --build-arg GEOINTEL_INSTALL_AI=true \
   --build-arg GEOINTEL_BUILD_SHA=local \
   --build-arg GEOINTEL_BUILD_TIME=local \
-  -t geointel-ci:local .
-bash scripts/generate_container_sbom.sh geointel-ci:local
-bash scripts/scan_container_image.sh geointel-ci:local
+  -t geointel-ci:local-ai .
+bash scripts/generate_container_sbom.sh geointel-ci:local-ai
+bash scripts/scan_container_image.sh geointel-ci:local-ai
 ```
 
 Outputs are written below ignored `artifacts/`; scanner cache is written below