feat(deploy): add Contabo release workflow and portal payload gate

www/reports/SESSION_HANDOFF.md

@@ -1,5 +1,26 @@
 # AIA Astro Migration — Living Session Handoff
 
+## Deployment and employee-portal release preparation — 2026-11-04
+
+The clinical director has accepted the collected non-PHI employee portal views,
+their interim shared-code presentation and the approved employee resources.
+This supersedes earlier collection/content-acceptance tasks. Deployment,
+filesystem permissions, protected-resource authorization, DNS and cutover remain
+separate technical gates.
+
+The site-side deployment workflow builds an indexing-enabled release with an
+explicit non-public approved portal ciphertext input, validates the artifact and
+Contabo-compatible manifest, uploads only commit-specific staging trees, then
+uses `aia-website-release verify`, `sync-source`, and `promote`. It does not
+rebuild NixOS or alter nginx. Employee documents are a separate owner-run,
+hash-verified resource-installation operation into the VPS-owned protected
+namespaces. See [the release runbook](../integrations/nixos/deploy.md).
+
+The browser payload remains ciphertext only; codes, plaintext portal content,
+private manifests and resources must never enter Git, `dist`, source snapshots,
+logs or deployment manifests. `/employee-portal` remains noindex and excluded
+from sitemap/hreflang. Form A, referral and publication behavior are unchanged.
+
 ## Current referral decision — 2026-11-01 (supersedes Form C planning)
 
 The owner directs `/referrals` to retain the current public-site workflow: one