feat: render Production lifecycle from the signed registry

[abrichr]

What changed

• production-lifecycle-source.json pins the canonical organization-profile commit (OpenAdaptAI/.github@6d882bd) and the SHA-256 of every lifecycle input: policy, admissions ledger, repository registry, the three evidence schemas, the policy schema, and the canonical validator itself.
• scripts/render_production_lifecycle.py fetches those exact commit-bound bytes, refuses any digest, URL, path, or inventory drift, runs the pinned canonical validator on the fetched inputs, and only then writes the remote-safe projection docs/production-lifecycle.json.
• The projection derives Production from the latest signed admission at read time: no static Production flag, no fallback to an older release when the latest admission expires or is revoked, and no invented state. docs/schemas/production-lifecycle-public.schema.json fixes the projection shape.
• docs/reference/production-lifecycle.md documents the admission contract (qualified workflow, release admission, current-state derivation) and is registered in the reference nav.
• .github/workflows/production-lifecycle-policy.yml re-renders with --check on pull requests, main pushes, manual dispatch, and a daily schedule, and files a durable issue on scheduled failure. The committed projection is also checked network-free by the test suite that ci.yml and the sync.yml deploy pipeline already run, so a stale, missing, malformed, or admission-bearing projection fails PR and deploy checks — the same fail-closed pattern the Flow version registry uses (feat: harden production readiness operations #128).

Current state

All seven targets render with latest_admission: null and an empty admission history. No visible lifecycle label or site claim changes. The page states explicitly that runnable does not mean admitted.

Coordination

The source pin references org-profile draft PR OpenAdaptAI/.github#11 at its current head. When that mechanism merges, refresh source_commit and the input digests, re-run the renderer, and commit the regenerated pin and projection in one PR.

Validation

• uv run pytest tests/ -q — 188 passed (includes 4 projection tests)
• python3 scripts/render_production_lifecycle.py then --check — rendered and validated against the live pinned commit; canonical validator reports 0 active admissions
• uv run python scripts/validate_docs.py
• uv run python scripts/check_published_version_claims.py --offline
• uv run mkdocs build --strict
• actionlint .github/workflows/production-lifecycle-policy.yml

🤖 Generated with Claude Code