feat(deployment): add secure Linux runtime (#17)

README.md

@@ -38,7 +38,11 @@ UDP hole punching cannot guarantee a direct connection through every network. Sy
 - `FinalFactory.Rendezvous.TestClient` — thin interactive and scriptable host/browser/join diagnostic built only on the public SDK.
 - `FinalFactory.Rendezvous.Tests` — unit, integration, security, and connection-lifecycle tests.
 
-The server directory and NAT mediator begin as separate modules in one deployable service because they share session, lease, authorization, and endpoint state. Their internal boundary should allow independent deployment later if scale, availability, or security requirements diverge.
+The server directory and NAT mediator are separate modules in one single-active
+deployable service because they share ephemeral session, lease, authorization,
+replay, and endpoint state. Their internal boundary can support a future
+explicitly designed shared-state architecture; operators must not create
+multiple active v1 replicas.
 
 ## Service boundaries
 
@@ -77,9 +81,11 @@ The initial service does not provide:
 
 Rendezvous is under active roadmap development. The versioned contracts,
 directory leases, authenticated join attempts, LiteNetLib mediator, caller-owned
-SDK coordination, typed connection outcomes, and thin public-SDK diagnostic client
-are implemented. Deployment hardening, the broader NAT-topology harness, and
-the production-readiness roadmap remain in progress;
+SDK coordination, typed connection outcomes, thin public-SDK diagnostic client,
+deterministic NAT topology harness, hostile-input controls,
+observability/operator surface, and secure single-active Linux deployment are
+implemented. Capacity, resilience, packaging, and final production-readiness
+gates remain in progress;
 participating games must not treat the current repository as a finished production
 service until those gates land.
 
@@ -94,6 +100,9 @@ defined in [hostile-input and overload protection](docs/security/abuse-protectio
 Health semantics, bounded telemetry, alerting, audit privacy, and the authenticated
 operator controls are defined in the
 [observability and operator runbook](docs/operations/observability-and-operator-runbook.md).
+The pinned non-root container, production topology, graceful drain, Linux
+hardening, smoke procedure, and recovery lifecycle are documented in
+[secure single-active Linux deployment](docs/deployment/linux.md).
 The scriptable host/browser/join diagnostic and its stable automation contract are
 documented in the [TestClient integration guide](docs/integration/test-client.md).
 The always-on three-party scenarios, optional Linux namespace topology, and
@@ -117,8 +126,9 @@ Run the bootstrap server with
 the configured UDP mediator port; both stop through normal host cancellation.
 The launch profile uses separate ephemeral development-only publisher and operator
 signing keys. Production
-startup fails closed until externally supplied game policies and `env:` signing
-key references resolve to valid key material; no reusable game secret is stored
+startup fails closed until its advertised endpoints, proxy trust boundary,
+externally supplied game policies, and `env:` (base64) or `file:` (raw,
+absolute, non-symlink) signing-key references resolve safely; no reusable game secret is stored
 in this repository or the public Client package.
 The project dependency rules and supported runtime choices are documented in
 [project and dependency boundaries](docs/architecture/project-boundaries.md).