[James3014]

Closes no Issue until live runtime readback. This bounded #399 Candidate removes the legacy bearer-authenticated HTTP mutation endpoints that could choose and activate an unbound release without Nexus deployment authorization. The authenticated /api/cutover/status endpoint remains; governed MCP cutover/restart/reconcile and physical deployment-effect fencing remain intact. Removes the global CUTOVER_SAFE_TOOLS admission allowlist in favor of deployment-effect classification while retaining existing coordination and idempotency safeguards.

Bound source: main 0b7c8e0387cc3f02a358eb2693f7a03783e04205; Candidate cbf742e4c3d466ba71e1b203936681956dc9fe92. No DevSpace src/server.ts changes, keeping it independent of PR #441 and merged RIE #446. A deterministic pre-fix RED witness observed HTTP /api/cutover/start returning 201 for caller-chosen target without deployment authority. Current src/cutover-http.test.ts is already wired into npm test and now asserts read-only-only HTTP registration, positive status readback and absence of release mutation. Focused cutover/convergence test: 24/24 PASS; typecheck PASS; build PASS. Three cutover-progression tests fail identically on unmodified base main, so they remain baseline-known, not claimed as Candidate PASS.

Exact-head Core/CI, independent review, integration, authorized runtime cutover and live negative canary remain gates. No authority to merge/deploy is implied by this PR.

[James3014]

Historical PR #448's exact-head Core failure was BASE_REF_NOT_ANCESTOR, not evidence that the #399 fix was semantically wrong.
The same six-file patch was requalified on current main by PR #450 (head 304a92e), passed 14/14 exact-head checks including Nexus Core and independent reviewer PASS_FOR_REVIEW, and merged as a3103fa.
This PR is therefore superseded and must not be merged as a second effect.
Issue #399 remains open until authorized live Dev M5 cutover and exact runtime readback prove the active generation and negative canary.