task: maintenance mode #597

Move this repo into maintenance mode.

Follows the apply-maintenance-mode skill, with quickstart-openshift as the golden path.

Checklist

• Pre-flight passed (no Tier-1 blockers). Re-run Oct 14 (DB upgrades deferred per Derek).
• Required results checks: Analysis Results and Validate Results are required in the builds ruleset (ci: gate PRs on per-workflow results checks and run unit tests #658), along with Builds (api|database|frontend).
• Required results checks cover every path Renovate updates: PR Results, Validate Results and Analysis Results required in the builds ruleset; results jobs use bcgov/actions/workflow-results (ci: gate results jobs with bcgov/actions/workflow-results #678). Workflow and frontend lint land in Analysis Results (ci: lint the frontend and workflows on pull requests #667).
• renovate-approve installed; recent Renovate PRs merged with its approval alone.
• bcgov/renovate-config pinned to a release (2026.9.26); weakening override removed (chore(renovate): use the preset's minimum release age #664).
• Release pipeline green on the default branch.
• PROD promotes the tested images: fix(ci): deploy merged pull request images on push to main #669 (deploys only merged PRs, using their tested images; PROD approval gate optional). Promotion is by PR tag, as in quickstart-openshift. Digest verification would be a follow-up.
• Hardening: docs: report vulnerabilities privately #665 (private vulnerability reporting), feat(chart): add startup probes to the API, frontend and database #668 (startup probes).
• API runtime matches the tested Node version (fix(api): run the API on Node 24, matching its build #666).
• Compose smoke test on PRs (ci: smoke-test docker-compose.yml on pull requests #671).

Steps for Derek

1. Scheduled crawler token (only if needed). The crawl runs as secrets.GITHUB_TOKEN. If the next scheduled Schedule Jobs run (daily, 5 PM PT) fails with No readable repositories found under bcgov; check that GIT_TOKEN can read them, then:

   1. GitHub → your avatar → Settings → Developer settings → Personal access tokens → Fine-grained tokens → Generate new token.
   2. Resource owner: DerekRoberts. Repository access: Public repositories. No extra permissions. Pick an expiry, then Generate token.
   3. bcgov/pubcode → Settings → Secrets and variables → Actions → New repository secret. Name it CRAWLER_TOKEN, paste the token, then Add secret.
   4. Ask for the one-line PR that passes secrets.CRAWLER_TOKEN as GIT_TOKEN in scheduled.yml.

   This needs no org-owner rights. Ministry-name PRs opened by the scheduled job still need a close and reopen to start their checks; a token that fixes that needs write access to bcgov/pubcode, which org policy may not allow for personal tokens.

Merged maintenance PRs

#664, #665, #666, #667, #668, #669, #671, #678.