chore(release): synchronize main into dev

[moscowchill]

Summary

• merge the two main-only opsec documentation commits into dev so the release PR can be merged cleanly
• retain dev's stronger public-repository posture: the validator runbooks remain untracked and operational details remain in the maintainer-internal runbook
• preserve the current v2.3 deployment status document and all reviewed source exactly

Validation

• the resolved tree is byte-for-byte identical to the current dev tree
• no contract, frontend, deployment, infrastructure, or chain-state behavior changes
• CI must pass before merge