task: maintenance mode #597

Move this repo into maintenance mode.

Follows the apply-maintenance-mode skill, with quickstart-openshift as the golden path.

Checklist

• Pre-flight passed (no Tier-1 blockers). Re-run Oct 9: Results checks, tests, review and the release pipeline pass. Still open: the local minimumReleaseAge override (chore(renovate): use the preset's minimum release age #664), and workflow and frontend lint for Renovate updates (ci: lint the frontend and workflows on pull requests #667).
• Required results checks: PR Results, Analysis Results and Validate Results are required in the builds ruleset (ci: gate PRs on per-workflow results checks and run unit tests #658).
• Required results checks cover every path Renovate updates: ci: lint the frontend and workflows on pull requests #667 (workflow and frontend lint) and fix(api): run the API on Node 24, matching its build #666 (API runtime matches the tested Node version).
• renovate-approve installed; recent Renovate PRs merged with its approval alone.
• bcgov/renovate-config pinned to a release (2026.9.26); weakening override removed: chore(renovate): use the preset's minimum release age #664.
• Release pipeline green on the default branch.
• PROD promotes the tested images: fix(ci): deploy merged pull request images on push to main #669 (deploys only merged PRs, using their tested images; PROD approval gate optional). Promotion is by PR tag, as in quickstart-openshift. Digest verification would be a follow-up.
• Hardening: docs: report vulnerabilities privately #665 (private vulnerability reporting), feat(chart): add startup probes to the API, frontend and database #668 (startup probes).

Steps for Derek

1. Review and merge chore(renovate): use the preset's minimum release age #664, docs: report vulnerabilities privately #665, fix(api): run the API on Node 24, matching its build #666, ci: lint the frontend and workflows on pull requests #667, feat(chart): add startup probes to the API, frontend and database #668 and fix(ci): deploy merged pull request images on push to main #669, in any order; they touch separate files. After fix(ci): deploy merged pull request images on push to main #669 merges, watch its first Merge to Main run: TEST deploy, Cypress, then PROD.

2. No ruleset change is needed. The new lint jobs feed Analysis Results, which is already required.

3. Scheduled crawler token (only if needed). The crawl runs as secrets.GITHUB_TOKEN. If the next scheduled Schedule Jobs run (daily, 5 PM PT) fails with No readable repositories found under bcgov; check that GIT_TOKEN can read them, that token can't list the org's repositories. Then:

   1. GitHub → your avatar → Settings → Developer settings → Personal access tokens → Fine-grained tokens → Generate new token.
   2. Resource owner: DerekRoberts. Repository access: Public repositories. No extra permissions. Pick an expiry, then Generate token.
   3. bcgov/pubcode → Settings → Secrets and variables → Actions → New repository secret. Name it CRAWLER_TOKEN, paste the token, then Add secret.
   4. Ask for the one-line PR that passes secrets.CRAWLER_TOKEN as GIT_TOKEN in scheduled.yml.

   This needs no org-owner rights. Ministry-name PRs opened by the scheduled job still need a close and reopen to start their checks; a token that fixes that needs write access to bcgov/pubcode, which org policy may not allow for personal tokens.