CI-001D4: guard staging App Check Hosting deploy

[daliu]

Outcome

Adds an argument-closed, staging-only Firebase Hosting release path for the App Check rollout. A staging deploy now requires the exact club account/project/quota/scope, an in-memory short-lived token, Firebase CLI 15.24.0, no credential-file override, and a bounded non-placeholder reCAPTCHA Enterprise public site key. The executable artifact verifier must find that selected key in built JavaScript.

Closes the source phase of #676. Provider configuration, Hosting publication, enforcement, and browser proof remain a separate post-merge phase under the same issue.

Officer impact: No website or provider behavior changes from this pull request. Backup officers gain a plain-language review procedure that distinguishes a source guard from live App Check.

Officer documentation: OFFICER_START_HERE.md, docs/officers/README.md, docs/officers/PUBLISH_AND_CHECK.md, and docs/officers/SYSTEM_MAPS.md.

Deployment evidence: Source and tests only. No Firebase API, reCAPTCHA key, App Check registration/enforcement setting, Hosting version, Function, billing link, IAM binding, user, record, production Firebase surface, Netlify deploy, DNS setting, or runmprc.com behavior changed.

Source boundary

• Adds scripts/firebase-hosting-staging-contract.js and exact package lifecycle commands.
• Extends the existing Hosting deploy/artifact contract only for staging App Check key presence.
• Extends the existing focused Hosting contract suite with positive and negative source, environment, CLI, artifact, and redaction cases.
• Updates authoritative engineering and officer-facing status/rollback documentation.

Verification

• Node 20 focused Hosting/App Check contract: 15/15 passed.
• Node 20 protected/release/source suite: 129/129 passed.
• Frontend lint baseline: 120 files, 113 reviewed legacy errors, 6 reviewed legacy warnings.
• Changed-file ESLint: 0 errors; four pre-existing/CommonJS-style warnings.
• Frontend Jest: 18 suites, 1,346/1,346 passed.
• SPA navigation: 11/11 passed.
• Functions lint: passed.
• Functions Jest: 69 suites and 7,569/7,569 applicable tests passed; two established emulator-only suites skipped by the standard command.
• Firestore Rules with Node 20/Java 21: 5 suites, 418/418 passed.
• Production-style synthetic staging build with App Check key shape: compiled; artifact verifier passed.
• Production audits unchanged: root 4 findings (1 high, 2 moderate, 1 low); Functions 8 moderate.
• Markdown fences, JSON, git diff --check, fixed-output canaries, and sensitive-shape review passed.

Security review

• Staging only; production and the demo emulator alias are rejected.
• Hosting only; broad/Function/Auth/Firestore scopes and appended CLI arguments are rejected.
• Exact club account/project/quota declaration and short-lived token path are required.
• ADC, GitHub credential path, gcloud credential override, and Firebase service-account material are rejected.
• Placeholder, malformed, missing, whitespace, overlong, production-equal, or artifact-absent site keys are rejected.
• Local/test and credential-free Netlify preview builds remain unchanged.
• The public key is never returned or printed by the guard; failures use one fixed diagnostic.
• App Check remains additive to Authentication and Firestore Rules and grants no membership, role, payment, or admin authority.

[netlify]

✅ Deploy Preview for luminous-fox-7c393f ready!

Name	Link
🔨 Latest commit	0195402
🔍 Latest deploy log	https://app.netlify.com/projects/luminous-fox-7c393f/deploys/6a8f62639fcdd2000829aaf8
😎 Deploy Preview	https://deploy-preview-677--luminous-fox-7c393f.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[daliu]

Temporarily closing to retrigger the missing required CI event; source commit remains unchanged.

[daliu]

Reopened unchanged to request the required exact-commit CI run.

[daliu]

Self-review complete on exact head 0195402c86c685ae0ce44ce180c0b70a70a9ef77: no findings. I checked staging/project/account/scope binding, package/lock/CLI pinning, appended-argument rejection, credential-file rejection, fixed diagnostics, site-key shape and artifact presence, local/preview compatibility, production exclusion, officer continuity, and unchanged billing/Functions/provider boundaries. CI run 33017961284 passed all five required jobs; Netlify preview/header/redirect checks passed and Pages changed was neutral.