Upgrade the image CA store and certifi to 2026.10.23 so forged certificates chaining to emSign ECC Root CA - G3 are rejected.
dj_queue expects connection.notifies() (psycopg3); psycopg2 exposed notifies as a list and caused TypeError loops in the worker.
Unignore site/ (was blocked by mkdocs /site rule), add compose/Docker/uv tooling, and split deploys so push to main goes to beta while prod stays manual.