Retire SellYourOutboard grants for deleted preview workflows

[shiny-code-bot]

Current Status

The August 5, 2026 closeout audit for #1986 confirms the new managed sellyouroutboard-preview facade and temporary ingress grants are fully retired. A deeper active-policy read also found legacy GitHub Actions grants that still reference .github/workflows/preview-control-plane.yml and .github/workflows/preview-cleanup.yml, which SellYourOutboard PR #203 deleted.

These grants are outside the new operator.generic-web-preview managed set, so its contract/retire workflow cannot remove them. No hand-authored policy JSON or direct DB mutation should be used.

Finish Line

The active authorization policy contains no grants for SellYourOutboard workflow paths deleted by PR #203, while stable deploy, promotion, cleanup, and operator authority remain unchanged.

Acceptance Criteria

• Inventory every active rule referencing the two deleted workflow paths and classify its source/ownership.
• Add or use a typed managed adoption-and-retirement path with dry-run, reviewed diff, protected apply, and active-policy audit.
• Remove only grants for deleted preview workflow paths; preserve current stable deploy, production promotion, artifact protection, lifecycle backstop, monitoring, and operator rules.
• Prove the deleted paths cannot mint authorized preview refresh, destroy, or feedback requests.
• Record the terminal policy revision and update the Prove frictionless onboarding on SellYourOutboard #1986 closeout thread.

Relationships

• related: Prove frictionless onboarding on SellYourOutboard #1986
• related: Make Launchplane generic-product onboarding frictionless #1966
• related: cbusillo/sellyouroutboard#203

• related: Prove frictionless onboarding on SellYourOutboard #1986 - Prove frictionless onboarding on SellYourOutboard #1986
• related: Make Launchplane generic-product onboarding frictionless #1966 - Make Launchplane generic-product onboarding frictionless #1966