feat: release gate, contract drift detection, setup diagnostics and session revocation

[privexlabs]

Summary

One focused vertical slice per issue, each reusing the existing modules instead of adding parallel ones.

Changes

• Trellis: Add release gate for tests, migrations, and rollback evidence #372: src/common/release/release-gate.ts combines test results, migration safety (existing verifyMigrationReadiness), and a recorded rollback rehearsal (presence, outcome, age, required fields, rollback safety) into one PASS/BLOCKED decision. Waivers need an ADMIN approver and a reason and apply only to their own gate. npm run release:gate -- evidence.json exposes it to CI. Documented in docs/RELEASE_READINESS.md.
• Trellis: Implement cross-service contract drift detection #371: detectContractDrift in src/common/contract/cross-service/ compares a released baseline with the cross-service contract map and reports removed events, producer changes, required-field and payload-type changes, removed consumers, version regressions, and breaking changes without a major bump. A major bump acknowledges breaking findings. Documented in docs/CROSS_SERVICE_CONTRACT_MAP.md.
• Trellis: Create contributor diagnostics for local setup failures #370: scripts/diagnostics.ts gains env:template-drift (names of .env.example variables missing from .env, never values) and env:PORT (invalid or in-use API port), backed by tested pure functions in src/diagnostics/diagnostics-checks.ts. Documented in docs/DEVELOPER_DIAGNOSTICS.md.
• Trellis: Add stale-session and token revocation handling #369: TokenBlacklistService gains a per-subject session cutoff (revokeSubjectSessions, isSessionStale; Redis-backed with local fallback, forward-only). JwtStrategy rejects stale sessions and POST /auth/logout records a cutoff so access tokens on other devices stop working. No API shape change or migration. Documented in docs/SESSION_REVOCATION.md.

Each doc covers edge cases and recovery/rollback. Existing contracts are preserved; the new behavior is additive.

Issues

Resolves #372
Resolves #371
Resolves #370
Resolves #369

Verification

Manual code and diff review only. Unit specs were added for every change (release gate, contract drift, diagnostics checks, token blacklist cutoff, JWT strategy) covering normal, failure, retry, and authorization paths. cargo build and cargo test were not run, and no other build, lint, or test command was run either, so the new specs have not been executed.

[drips-wave]

@privexlabs Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[github-actions]

Code Review & Auto-Merge — @dorismaduegbunam 🚀

Thank you @privexlabs for your contribution!

• PR Title: feat: release gate, contract drift detection, setup diagnostics and session revocation
• Author: @privexlabs
• Branch: feat/369-372-session-drift-diagnostics-release-gate -> main
• Linked Issues: Closes Trellis: Add release gate for tests, migrations, and rollback evidence #372, Closes Trellis: Implement cross-service contract drift detection #371, Closes Trellis: Create contributor diagnostics for local setup failures #370, Closes Trellis: Add stale-session and token revocation handling #369
• Status: Approved & Merged into main.

Verified code changes and repository requirements. Merging pull request.