Derive Production state from signed admissions

[abrichr]

What changed

This removes static Beta and Early Access labels from OpenAdapt's seven product targets. It keeps released capability and bounded evidence separate from Production admission.

The browser reads a same-origin endpoint. The server verifies the pinned canonical admission record, current release artifacts, and acceptance evidence. It returns not actively admitted when a required check fails. The Trust Center and machine-readable status files use the same result.

Why

A release doesn't enter Production because it exists or passed one demonstration. Each target needs a current signed, expiring, and revocable admission. Product-wide Production needs active admissions for all seven targets.

Checks

• 222 tests passed
• Production build passed with 45 pages and the API route
• Canonical lifecycle projection check passed
• Local built endpoint returned HTTP 200 with both no-store headers
• All seven targets returned not actively admitted with the current empty admission ledger
• git diff --check passed

[netlify]

✅ Deploy Preview for cosmic-klepon-3c693c ready!

Name	Link
🔨 Latest commit	f318a8e
🔍 Latest deploy log	https://app.netlify.com/projects/cosmic-klepon-3c693c/deploys/6a8f487294faae00084b9b0d
😎 Deploy Preview	https://deploy-preview-382--cosmic-klepon-3c693c.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.