docs(integration): HCG tier-2 rollout & rollback runbook (Phase E E5 draft) (#128)

## Summary

First Phase E artefact for the HCG tier-2 channel (`standards#91`,
sub-issue `standards#100`). Pure documentation — no code. Lands the
rollout/rollback runbook design **before** any wiring/traffic-shift PR
so the operational vocabulary (traffic-shift mechanics, rollback
triggers, dashboards) is fixed first.

`Refs hyperpolymath/standards#100` (NOT Closes — joint-close is
owner-only).
`Refs hyperpolymath/standards#91`.

## Why this PR first

Per the first-session plan posted on `standards#100`:
- E5 (runbook) lands first because it is the lowest-risk Phase E
artefact, captures design while context is fresh, and has no Phase D
dependency.
- E1/E2/E3/E4 (Containerfile / staging deployment / telemetry /
production flip) are explicitly **gated** on Phase D-3 (regression alert
armed) + D-4 (real baseline numbers). Phase D is currently scaffold-only
(`http-capability-gateway#12` merged 2026-05-20T08:24Z;
`bench/baseline.json _status: "scaffold-placeholder"`).
- Several operational fields (on-call rota, dashboard URLs, prod cert
material, traffic-shift mechanism) need **owner input** — drafting now
surfaces those gaps so they can be filled async rather than blocking a
code PR mid-rollout.

## What's in

`docs/integration/hcg-tier2-rollout-runbook.md` — 308 lines, six
sections + two appendices:

1. **Prerequisites checklist** — Phase D landings, Phase A/B/C artefact
pointers, operational `!OWNER:` block, BoJ-side prereqs, gateway-side
prereqs.
2. **Staging cut-over** — deploy procedure, telemetry verification (per
plan §E3), 24h soak, rollback rehearsal (per Phase E acceptance:
"runbook has been **tested**").
3. **Production rollout** — 10% → 50% → 100% → decommission, with
explicit soak windows and per-step sign-off.
4. **Observability** — signals (gateway-side and BoJ-side), dashboard
placeholders.
5. **Rollback** — triggers (with concrete thresholds), immediate-bypass
procedure, permanent-disable procedure, post-decommission rollback (the
expensive case).
6. **Post-rollout verification + Trustfile flip** — the final close-out:
`Trustfile.a2ml
[CLOUDFLARE_EDGE_SECURITY].rate_limiting.tier_2_gateway.status` PENDING
→ DEPLOYED (line ~900).

Plus appendices for glossary + cross-references.

## File placement

`docs/integration/hcg-tier2-rollout-runbook.md` — chosen because:
- Sibling integration docs
(`http-capability-gateway-{plan,audit,boj-contract,policy-authoring}.md`)
are `.md` in this directory; consistency beats the estate `.adoc`
default for the integration set.
- Plan §E5 normatively prescribes `.md` ("File:
`docs/integration/gateway-rollback-runbook.md`").
- The runbook fold-in (rollout + rollback in one doc) reflects Phase E
acceptance criterion 3 of `standards#100` which asks for both. Renamed
`-rollout-runbook` rather than `-rollback-runbook` to reflect the wider
scope.

## What's deliberately deferred

- Real on-call rota / dashboard URLs / prod cert paths / traffic-shift
mechanism choice — `!OWNER:` markers throughout §1.3 and §4.3–4.4. Owner
fills these (likely async via separate edits or a follow-up PR).
- Cert-rotation runbook for the gateway TLS CA — plan §E1 calls this out
as a separate artefact; this runbook only references it.
- Phase D real numbers — populated by D-4; this runbook references the
baseline without quoting numbers.

## Verification done locally

- File renders as Markdown (no AsciiDoc syntax mixed in).
- All in-document links target real paths (`docs/decisions/0004-...`,
sibling integration docs, source files at the line numbers cited).
- Cross-checked Phase C §3 invariant 3 status: line 73 of
`elixir/lib/boj_rest/trust_policy.ex` already contains the deny clause
(landed in `boj-server#106`, commit `40e46f6f`) — the runbook's §1.4
verify step is real, not aspirational.

## Test plan

Documentation-only PR — no CI run is the merge oracle. Specifically:

- [ ] Render check — Markdown renders cleanly in GitHub PR preview.
- [ ] Link check — all in-doc relative links resolve.
- [ ] Review check — owner reviews the `!OWNER:` block, identifies which
fields they want to fill now vs follow-up.
- [ ] Single-channel discipline check — this PR explicitly does NOT
progress Phase E execution; merging it does not affect production. The
Phase D gate (§1.1 of the runbook) remains the hard prerequisite to any
actual rollout work.

Draft until owner has reviewed the !OWNER: markers and decided which to
fill in this PR vs follow-up.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath