docs(dnn): #131 go-live gate capstone — consolidated executable runbook

[jsboige]

Scope

Dispatch ai-01 msg-20260723T024927-zwcvck (primaire). Capstone that transforms the scattered staged docs (#854 machineKey, #442 web.config hardening, dnn10-migration-readiness.md, skin diagnostic #851) into ONE top-to-bottom procedure jsboige executes on go-live day.

File

docs/dnn/go-live-gate-runbook.md:

• Block-head: 4 blocking arbitrages checklist (machineKey rotation / skin tabid=138 Opt 1 vs Opt 2 / [DNN i18n portage · 1/6] Portal / 2sxc App export — hard unblocker (jsboige) #681 2sxc export / T&A Relecture visuelle — paquet complet du jeu (64 PDF + mindmaps interactives, 8 langues) — pour Thomas & Adeline #802 return) — the cluster state (ai-01 04:52) is that the autonomous runway is quasi-exhausted and these 4 decisions gate the release.
• Body: canonical ordered sequence — A rotation server-side FIRST → B1 scrub bleed-stop (after rotation) → C verify fix(security): harden web.config — CSP, HSTS, cookies, crypto (#131) #442 hardening (already merged) → D DNN10 readiness → E 2sxc [DNN i18n portage · 1/6] Portal / 2sxc App export — hard unblocker (jsboige) #681 → F deploy ops(deploy): Production deployment — database migration and go-live #132 + ai-01 live verdict.
• Every step tagged: [jsboige-DECISION] / [po-2023-EXEC] / [ai-01-VERDICT].
• Each step points to its staged doc (does not duplicate content).
• chore(deps): Bump websocket-driver from 0.7.4 to 0.7.5 in /DNNPlatform/Portals/_default/Skins/Bootstrap 4 Instant #811 dependabot assessment folded in (secondaire) — transitive via ws, 0 prod runtime path, reco merge (not merged by worker; verdict = ai-01/jsboige). Comment already on chore(deps): Bump websocket-driver from 0.7.4 to 0.7.5 in /DNNPlatform/Portals/_default/Skins/Bootstrap 4 Instant #811.

Notes (code=truth)

• fix(security): harden web.config — CSP, HSTS, cookies, crypto (#131) #442 is MERGED (security headers on master, not HELD — hardening already applied). The capstone verifies presence, does not re-apply.
• docs(dnn): upgrade assessment — #131 security, migration path, eshop strategy #444 and ops(deploy): Production deployment — database migration and go-live #132 are CLOSED — referenced as context.
• HSTS in fix(security): harden web.config — CSP, HSTS, cookies, crypto (#131) #442 is commented — activate only when fully HTTPS in prod ([jsboige-DECISION]).

Constraints honored

• SECRET-SAFE: references by location only (0 key value, 0 SQL password, 0 connection string). Pre-commit secret-scan: 0 fragments, 0 long-hex. GitGuardian must pass.
• Staged / 0 execution of gated-ops. No web.config prod publish.
• Branche feature + PR, go-live verdict = ai-01 (po-2023 prepares/executes repo-side only).
• 0 prod CSV (gel T&A).

🤖 Worker po-2023