Foundry RAVE — hello world

B-M0 deploy-seam proof. This single static page was built and pushed to Amazon ECR through the keyless GitHub-OIDC pipeline — no long-lived AWS keys.

P3 CI → OIDC AssumeRoleWithWebIdentity → ci-image-push (ECR push only, no Terraform state) → docker push to the web repo, tagged with the immutable git SHA.