[Epic] Post-rebuild follow-ups

New follow-up tickets filed at the end of the rebuild session:

• PAR-450 Notification delivery: invite emails over SES (including purging tokens from delivered payloads), @mention notifier, notification preferences.
• PAR-451 Issues, board and projects gaps: board columns by any field, hide-finished for non-status groupings, deeper nesting, archive paging, sprint burn-up, project tabs and slugs, milestone drag-and-drop.
• PAR-452 Settings, public pages and sharing gaps: GitHub and API page restyle, shared views in Sharing, Follow, plan-gated badge, Share embed, OG font, onboarding seed.
• PAR-453 GitHub dev links: review and check state; check-run producers.
• PAR-454 Realtime across replicas (LISTEN/NOTIFY).
• PAR-455 Ops: drop rebuild from design.yml, ARC capacity, Actions billing, stale gitops comment, Argo CD Helm values drift, host isolation and CPU quota, Infisical passphrase rotation.
• PAR-456 Dev after the realm switch: dev UI issuer in Infisical, recreate the dev test account in the tasklie realm, re-run the smoke test.

Carried over: PAR-381, PAR-369, PAR-390, PAR-391, PAR-382, PAR-398 (moved to Todo with their remaining scope).

Engineering: PAR-442, PAR-443, PAR-445.

In flight at session end: hotfix #84 (935b021). It covers the staff break-glass audit writing inside read-only transactions, and staff landing on the alphabetically first workspace.

• The UI image is built, and the backend image was building on the tasklie ARC runner.
• Image Updater rolls both out automatically.

To verify:

• Production images are on production-sha-935b021.
• Signed in as staff, / lands on Paradaux.
• No cannot execute INSERT in a read-only transaction errors appear in the tasklie logs.

Hotfix #84 is live. Both production images are on production-sha-935b021, and /, /login and /w/paradaux return 200. The tasklie logs show no read-only transaction errors since the rollout.

Still to confirm: when Rían signs in as staff, / should land on Paradaux.

Published the architecture remediation stack in dependency order:

• PAR-473 cache ownership: #104
• PAR-474 approved synchronous inference boundary: #117
• PAR-475 typed issue writes: #118
• PAR-476 explicit absence: #119
• PAR-477 structured correlation: #120
• PAR-478 frontend public entry points: #121
• PAR-479 zero UI suppressions: #122
• PAR-480 verification map and missing guards: #123

Every PR targets the previous layer (first targets main). Cumulative local checks at 46d7c31 passed: 1,334 backend, 1,230 web unit and 480 browser story tests, plus lint/typecheck/API drift/production build/CSS checks. Story suite used the CI-prescribed retry for the known iframe import flake. PR #104 CI passed; new PR CI is running/queued. None merged or deployed. The verification map distinguishes enforcement from review requirements; residual tenant-index rule alignment is tracked in PAR-495.

All eight architecture remediation PRs are merged into main in dependency order: #104, #117, #118, #119, #120, #121, #122, #123. All PR CI passed before merging, with no unresolved review threads. Each child was retargeted to main and verified before its exact-head merge. The complete implementation head 46d7c31 is verified as an ancestor of main at b5d5ef5. PAR-473 through PAR-480 are Done; the CI heartbeat has been removed. Post-merge deployment workflows are separate from the completed PR verification. Remaining literal tenant-index rule alignment is tracked in PAR-495; the verification map documents review limits and does not claim universal compliance.