fix: harden ArchiveOS RC contracts and connect Managed Systems console

[CSJ-PJT]

Scope

• authenticated read relay hardening
• Archive service canonical identity normalization
• PM Inbox authorization and idempotency protection
• Managed Systems Console V3 subview connection
• Archive Runtime core systems exactly five

Explicit exclusions

• Archive-World
• Archive-lite
• Runtime timeline projection contract commit 554334a
• database migration
• DB data correction
• secret or environment value changes
• dependency version upgrades unrelated to tests

Commits

• 79ffe93 — runtime read relay and managed identity hardening
• c2324df — Managed Systems Console V3 connection

Validation

Local full Release Gate completed on head c2324df9a935e897fbe8be94068f862c4ac3956f:

• npm.cmd test — PASS (frontend routing, Managed Systems, PM Inbox, UI IA smoke)
• npm.cmd run build — PASS (frontend production build)
• cd backend && npm.cmd test — PASS (authenticated read relay 5/5 and migration proxy smoke)
• cd backend && npm.cmd run typecheck — PASS
• cd backend && npm.cmd run build — PASS
• cd archiveos-ai && .\gradlew.bat clean test build bootJar — PASS
• docker compose --env-file <untracked-env> -f docker-compose.yml -f docker-compose.rc.yml config --quiet — PASS
• isolated backend / ArchiveOS AI / frontend image build — PASS
• current main container health, restart and OOM read-only check — PASS
• canonical identity scan — PASS
• secret literal scan — PASS
• git diff --check — PASS
• official correlation read-only verification — COMPLETE_CHAIN, event 35, source 4, ROOT 1, external gap 0, invalid causation 0, duplicate eventId 0

Integrated isolated smoke status will be updated after the disposable Compose environment is validated and removed.

Operational state

• ArchiveOS RC code: PASS
• Archive ecosystem operation: DEGRADED
• Market: HTTP 401
• Nexus: runtime evidence not recorded
• Official correlation: COMPLETE_CHAIN, event 35, source 4

PR Gate

• Remote CI: NOT_CONFIGURED / NO_RUN
• Local full Release Gate: PASS
• Isolated integrated browser smoke: PENDING
• OS PM manual review required

No merge, deployment, tag, release, squash, rebase, or main push is authorized by this PR.