Closes gap-analysis v2 §8.1 / §8.4 / §8.6 and §10.1 / §10.2.
- assertProductionEnv() in config/env.ts fails-fast in NODE_ENV=production
when SESSION_SECRET / EVENT_BUS_HMAC_SECRET / CHAIN_138_RPC_URL /
NOTARY_REGISTRY_ADDRESS / ORCHESTRATOR_PRIVATE_KEY / DATABASE_URL is
missing or uses the dev placeholder. Catches the silent-degrade-to-mock
failure mode that would turn the Ledger Anchor back into a lie.
- New EVENT_BUS_HMAC_SECRET env added to the schema.
- .github/workflows/ci.yml rewritten: portal jobs target repo root (not
the removed webapp/ gitlink), orchestrator type-check + test job
added, contracts jobs kept as-is.
- 7 unit tests for assertProductionEnv; full suite 87/87 green.