Record controlled AWS validation and runtime fixes

[krishna310301]

Summary

• retain sanitized HPA, SLI, runtime, lifecycle, findings, and closure evidence for the controlled v1.2.1 run
• add numeric backend runtime identities and a rendered security-context CI contract
• make CloudWatch auto-instrumentation opt-in for the restricted namespace and harden database-secret framing
• replace the historical 99.5% headline with the current 18,819-request zero-failure result while preserving the old run as history

Validation

• 18 backend tests passed
• 34 evidence/recovery and manifest-contract tests passed
• 3 frontend tests and production build passed
• Helm lint/render, NetworkPolicy, observability, runtime-security, and kubeconform validation passed (36/36 resources)
• native Terraform validation and cost guardrails passed
• evidence hashes, compiled HPA reproducibility, findings links, and sensitive-data scans passed

AWS closure

• 54 managed resources destroyed; Terraform state is empty
• 13 project-scoped service-native inventories returned zero
• Resource Groups Tagging API retained four historical mappings and is explicitly inconclusive because AWS documents GetResources as returning tagged or previously tagged resources

Claim boundary

This validates one controlled deployment, HPA exercise, short-window SLI measurement, runtime-control review, and same-day teardown. It does not claim production capacity, monthly SLO compliance, or managed failure resilience.