feat(modernization): full architecture blueprint with hardening follow-up

Implement phased modernization infrastructure for transitioning from
multi-page legacy routing to SPA portal-shell architecture, plus
post-delivery hardening fixes for policy loading, fallback consistency,
and governance drift detection.

Key changes:
- Add route contract enrichment with scope/visibility/compatibility policies
- Canonical 302 redirects from legacy direct-entry to /portal-shell/ routes
- Asset readiness enforcement and runtime fallback retirement for in-scope routes
- Shared feature-flag helpers (env > config > default) replacing duplicated _to_bool
- Defensive copy for lru_cached policy payloads preventing mutation corruption
- Unified retired-fallback response helper across app and blueprint routes
- Frontend/backend route-contract cross-validation in governance gates
- Shell CSS token fallback values for routes rendered outside shell scope
- Local-safe .env.example defaults with production recommendation comments
- Legacy contract fallback warning logging and single-hop redirect optimization

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.github/workflows/full-modernization-gates.yml

@@ -0,0 +1,57 @@
+name: full-modernization-gates
+
+on:
+  pull_request:
+    paths:
+      - "frontend/src/portal-shell/**"
+      - "frontend/src/qc-gate/**"
+      - "frontend/tests/portal-shell-*.test.js"
+      - "src/mes_dashboard/**"
+      - "tests/test_portal_shell_routes.py"
+      - "tests/test_full_modernization_gates.py"
+      - "tests/test_asset_readiness_policy.py"
+      - "scripts/check_full_modernization_gates.py"
+      - "docs/migration/full-modernization-architecture-blueprint/**"
+      - "openspec/changes/full-modernization-architecture-blueprint/**"
+      - ".github/workflows/full-modernization-gates.yml"
+  push:
+    branches: [ main ]
+    paths:
+      - "frontend/src/portal-shell/**"
+      - "frontend/src/qc-gate/**"
+      - "frontend/tests/portal-shell-*.test.js"
+      - "src/mes_dashboard/**"
+      - "tests/test_portal_shell_routes.py"
+      - "tests/test_full_modernization_gates.py"
+      - "tests/test_asset_readiness_policy.py"
+      - "scripts/check_full_modernization_gates.py"
+      - "docs/migration/full-modernization-architecture-blueprint/**"
+      - "openspec/changes/full-modernization-architecture-blueprint/**"
+      - ".github/workflows/full-modernization-gates.yml"
+
+jobs:
+  frontend-route-governance:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+      - name: Run shell governance tests
+        run: node --test frontend/tests/portal-shell-navigation.test.js frontend/tests/portal-shell-route-contract-governance.test.js
+
+  backend-modernization-gates:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.13"
+      - name: Install test dependencies
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install -e . pytest
+      - name: Run modernization governance gate script
+        run: python scripts/check_full_modernization_gates.py --mode block
+      - name: Run backend canonical/fallback gate tests
+        run: python -m pytest tests/test_portal_shell_routes.py tests/test_full_modernization_gates.py tests/test_asset_readiness_policy.py -q