feat: close production trust and operations gates

.github/workflows/provider-promotion-canary.yml

@@ -33,6 +33,10 @@ on:
         description: "Maximum revocation or kill-switch propagation SLA"
         required: false
         default: "300"
+      max_observation_age_seconds:
+        description: "Maximum accepted age of each no-cache readiness response"
+        required: false
+        default: "120"
 
 permissions:
   contents: read
@@ -65,6 +69,7 @@ jobs:
           EXPECTED_KEY_ID: ${{ inputs.expected_key_id }}
           EXPECTED_IMAGE_DIGEST: ${{ inputs.expected_image_digest }}
           PROPAGATION_DEADLINE_SECONDS: ${{ inputs.propagation_deadline_seconds }}
+          MAX_OBSERVATION_AGE_SECONDS: ${{ inputs.max_observation_age_seconds }}
         run: |
           set -euo pipefail
           umask 077
@@ -76,6 +81,7 @@ jobs:
             --node "$NODE_A"
             --node "$NODE_B"
             --service-key-file .promotion-control-private/service-key
+            --max-observation-age-seconds "$MAX_OBSERVATION_AGE_SECONDS"
           )
           if [ "$MODE" = "canary" ]; then
             args+=(