ci: require manual gated releases from main

docs/ROADMAP.md

@@ -14,6 +14,9 @@ kept through the approved order; 4.6 now pages pending and approved unpaid
 quotes, including a tested 101st pending quote. Operational entrypoints in
 5.12 are repaired and locally exercised. Image decoding, mixed-sheet grading,
 rotation-sensitive DPI, and PDF page geometry are corrected in 3.9/4.4.
+`main` pushes now validate without publishing; manual release requires a passing
+source preflight. The containerized browser gate passes locally, pending a Gitea
+runner run.
 Next address the upload/scanner safety gate and unsupported PDF image evidence.
 The customer/API upload admission now stops above the scanner's effective limit
 before transfer; the 5 GiB large-file product path still needs agreement and
@@ -598,14 +601,9 @@ print-file evidence still need correction before this item can close.
   integration job should run `down -v` before `up` — or a dedicated step should
   apply `schema.sql` twice to a fresh database, proving both a first install and
   a re-run.
-- `[ ]` 5.10 — The browser suites do not run in CI. Chrome runs in the runner
-  container and can only reach the stack through ports published on the host, which
-  is a different network namespace when the runner is itself a container. The API,
-  workflow, security, scanning, retention and runtime suites were moved inside the
-  stack's network and do gate. The browser suites are the only coverage for the
-  artwork editor and the full customer journey, so they need either Chrome in a
-  container on that network, or a runner with host networking. Until then they gate
-  locally only, and CI warns when it skips them.
+- `[ ]` 5.10 — The browser suites were moved into a Chrome container on the
+  Compose network and made required in CI. Confirm the complete checkout journey
+  passes in that topology and on the actual Gitea runner before closing this item.
 - `[ ]` 5.9 — `local/browser_test.mjs` failed once and passed on an immediate
   re-run, with no code change in between (2026-09-21). It is a deploy gate when the
   runner has Chrome, so an intermittent failure there blocks releases for no reason.
@@ -627,10 +625,12 @@ print-file evidence still need correction before this item can close.
 - `[ ]` 5.13 — Define production recovery: scheduled encrypted offsite database
   and object backups, a consistent snapshot boundary, Swarm data placement and
   a restore rehearsal that opens every required live order file.
-- `[ ]` 5.14 — Promote and verify one immutable release. Scan before publishing
-  mutable tags, make the source preflight validate the active stack, require the
-  browser tests to run, test clean install and upgrade, and check application
-  readiness after Portainer redeploys. Isolate concurrent CI stacks.
+- `[ ]` 5.14 — Promote and verify one immutable release. Normal `main` pushes
+  now run checks only; manual dispatch requires source preflight and a configured
+  webhook, and scans images before publishing. Still make the full preflight
+  validate the active stack, deploy the tested immutable image references, test
+  clean install and upgrade, check application readiness after Portainer
+  redeploys, and isolate concurrent CI stacks.
 
 ---