feat(stability): unify readiness and recovery

docs/QA_AUTOMATION.md

@@ -10,6 +10,44 @@ OpenClaw, PostgreSQL, browser, or load-test boundary. Archive the command,
 versions, sanitized output, dataset provenance, and timestamp for every
 acceptance run.
 
+## Release CI gates
+
+Every push now runs four independent pre-deployment jobs:
+
+- the normal .NET 10 build and test suite plus a High/Critical NuGet
+  vulnerability gate;
+- a mandatory Linux runner job with both
+  `NEXUS_RUN_DOCKER_INTEGRATION_TESTS=true` and
+  `NEXUS_RUN_TOXIPROXY_INTEGRATION_TESTS=true`;
+- frontend version parity, High/Critical production dependency audit,
+  typecheck, generated OpenAPI drift, unit tests, production build and the full
+  Playwright route matrix; and
+- a full-history Gitleaks v8.30.1 scan downloaded from the upstream release and
+  checked against its pinned SHA-256 before execution.
+
+Deployment depends on all four jobs. A missing Docker endpoint is therefore a
+failing integration job, not a successful skip. Local runs without Docker may
+still show five explicit skips, but they are not release acceptance evidence.
+The checked-in `.gitleaksignore` contains only exact fingerprints for reviewed
+historical findings; it is not a pattern-based bypass for new secrets.
+
+The repository SDK contract is `global.json`: .NET `10.0.100` with
+`latestFeature` roll-forward. `VERSION` is the release source of truth;
+frontend package version and OCI image labels are checked against it.
+
+## Browser route and recovery gate
+
+The fixture Playwright profile sets `VITE_BROWSER_TELEMETRY_ENABLED=false`, so
+expected telemetry proxy failures cannot mask application regressions.
+Production container builds enable the allow-listed browser metrics explicitly.
+
+The route suite covers Login plus all 20 authenticated views at 375, 768, 1024,
+1440 and 1920 px. It also checks deep links, shared-query deduplication, one
+targeted resync after an SSE sequence gap, retained Task Board content during a
+refresh, Done pagination, drag-and-drop, and distinguishable dependency
+outage/retry recovery. These are controlled browser contracts, not a
+credentialed production or real OpenClaw acceptance run.
+
 ## Task Board load gate
 
 The full k6 profile holds ten virtual users for two minutes and fails when: