EPIC: GPU-less go-live

[ahmetabdullahgultekin]

Umbrella for the CPU-only (Hetzner) go-live queue — host the models, flip the client-side-embedding flags in the safe order (identity→web), and prove the biometric path in the real product on two devices. Children live in their own repos; this epic just tracks the queue and the deploy blockers gating it.

Deploy blockers (must clear first)

• [BLOCKER] Hetzner self-hosted runner not claiming Deploy jobs #171 — Hetzner self-hosted runner not claiming Deploy jobs
• [BLOCKER] infra/deploy.sh has no 'biometric' build branch #172 — infra/deploy.sh has no 'biometric' build branch

Model hosting + flag flip (ordered)

• Bio rebuild + deploy enrollment-probe endpoints (PR #144) — bio FIRST biometric-processor#148 — rebuild + deploy enrollment-probe endpoints (bio FIRST)
• Host facenet512 fp16 model + flip SP-A flags (identity→web), re-enroll, 2-device verify identity-core-api#226 — host Facenet512 fp16 + flip SP-A flags (identity→web), re-enroll, 2-device verify
• Voice canary: verify-in-real-product after enrollment-probe deploy biometric-processor#150 — voice canary: verify-in-real-product after enrollment-probe deploy

Decisions gating go-live

• DECISION: M1 KYC-gate / binding-assurance policy (go-live gate) identity-core-api#227 — M1 KYC-gate / binding-assurance policy
• DECISION: dual-spoof / amispoof PAD — swap SP-D to real MiniFASNet single-frame? biometric-processor#149 — dual-spoof / amispoof PAD: swap SP-D to real MiniFASNet single-frame?

Order: clear #171/#172 → bio #148 → identity #226 (flag identity BEFORE web) → voice #150; decisions #227/#149 in parallel.