[jmgasper]

Move the ECS deployment migration onto current dev and pin tc-deploy-scripts v2.0.5, fetched by tag and verified against bff574ab5c0b46773e25d2af1eff76675fba2ba5. Build jobs remain separate from the deployment context; production remains approval-gated on its existing production branch. Current dev application/dependency fixes are preserved. The security prerequisite’s legacy-peer-deps=true and install-links=true settings are explicit in npm CI commands. This preserves its existing lockfile/dependency behavior without restoring a committed .npmrc; the Docker build already supplies the same settings. Source checkout uses the public HTTPS repository and verifies the exact CircleCI commit, avoiding dependency on failing SSH checkout keys. No GitHub token is added to build or deployment contexts.

Per-service OIDC replaces the Auth0/SSM broker path. The deployment role, matching boundary and STS session explicitly deny Parameter Store, Secrets Manager, KMS decryption and role chaining. Runtime roles and secret references remain owned by ECS infrastructure. Matching private IAM policies include the region-restricted Inspector list permissions required for enhanced scanning; those scan-metadata APIs require Resource *.

Draft: dev resource identities are verified; infrastructure prerequisites remain before merge. deploy/dev.json and matching private IAM templates were prepared from live AWS inventory. No resources or service capacity were changed. Remaining prerequisites:

• Install the service deployment role and matching permissions boundary.
• Create the restricted empty CircleCI deployment context.
• Review and install the dev container health-check proposal; preserve all other task configuration.
• Merge security prerequisite PR fix: remediate API, frontend and build security vulnerabilities #112 before this PR.
• Move baked runtime configuration into reviewed ECS secret references; current dev task has no references.
• Establish a separately scoped frontend release before disabling Jenkins.

IAM templates, baselines and provisioning status remain in the private service directory. No infrastructure files have been reintroduced into the application PR history.

Validation: CircleCI CLI configuration validation; manifest/policy/trust consistency where project identity is available; shell syntax and git diff checks; service-specific Python deployment regressions in the pinned executor. Shared suite v2.0.5 has 82 passing tests. PR checks will report application builds separately. Live OIDC, functional smoke, rollback and wrong-project/ref tests remain rollout acceptance gates.

Prerequisite: merge security PR #112 first. This PR now targets dev and retains that dependency in its ancestry, so its diff temporarily includes the prerequisite changes. A separate frontend release and runtime configuration migration remain required.