fix(#251): enforce strict website_scan v2 contract

[mottych]

Summary

• Enforce a strict website_scan v2 response contract with canonical fields only (no legacy alias handling).
• Normalize business profile fields for reliability (business_description, industry, year_founded, business_address) and reject legacy flat payload shapes.
• Make scan_id and captured_at server-owned metadata that are always generated at validation time.
• Update retrieval/spec docs/prompts and stabilize preprod deploy reliability for the shared coaching ECR repository.

Incident Context

Issue #251 reported missing or noisy business profile data from website scans. Root cause was permissive/variable payload handling and unconstrained metadata values.

Validation Evidence

• Preprod deploy run succeeded: https://github.com/mottych/PurposePath_AI/actions/runs/22984795257
• Manual preprod validation confirmed:
  • business_profile.business_address is present (and headquarters_location is absent)
  • industry is constrained/normalized to allowed enum values
  • scan_id and captured_at are server-generated per response

Test Plan

• uv run ruff check coaching/src/api/models/onboarding.py coaching/tests/unit/test_onboarding_models.py coaching/src/core/topic_seed_data.py coaching/src/core/retrieval_method_registry.py
• uv run mypy coaching/src/api/models/onboarding.py --explicit-package-bases
• uv run pytest coaching/tests/unit/test_onboarding_models.py -k WebsiteScanResponse
• Preprod manual validation against incident scenario
• Production post-deploy verification after merge

[pulumi]

🍹 The Update for mottych/purposepath-coaching-api/preprod (at 96d1e98) was successful.

✨ Neo Explanation

A new coaching API Docker image has been built and is being deployed to the preprod Lambda function, updating the container from the previous image version to the newly built one. This is a routine code deployment with no risk of downtime or data loss.

Root Cause Analysis

A new version of the coaching API application has been built and is being deployed to the preprod environment. The Docker image was rebuilt with a new BUILD_TIMESTAMP of March 12, 2026, producing a new image digest, which triggers an update to the Lambda function to point to that new image.

Dependency Chain

A new Docker image (coaching-image) was built from the coaching Dockerfile → the image was pushed to ECR with a new content digest → the Lambda function (coaching-api) is updated to reference the new image URI. The remaining 21 resources (API Gateway, DynamoDB tables, IAM roles, etc.) are unaffected.

Risk analysis

No stateful resources are being replaced or deleted. This is a standard Lambda container image swap — the function will serve the new image on its next invocation with no infrastructure recreation required.

Resource Changes

    Name            Type                          Operation
~   coaching-image  docker:index/image:Image      update
~   coaching-api    aws:lambda/function:Function  update