Verify Easy Mode app publishing end

Found by the finish phase of epic 13411. The epic's core promise — "a push to its main branch publishes the app at `<slug>.apps.jaah.ai`, front-end and `/api` both answering" — plus cap pausing and app isolation have never run live. ## Observation - Apps account 863741479793 (`jaah-apps`), checked 2026-11-04 with `me/jaah/system/bootstrap-admin` → `OrganizationAccountAccessRole`: `aws service-quotas get-service-quota --service-code lambda --quota-code L-B99A9384 --region us-east-1` = 10.0; request for 1000 is `CASE_OPENED` (case 179373826700029, filed 2026-11-03, escalated by Task 13858). Every app reserves concurrency, so provisioning fails at the `aws_lambda` step (readable reason since PR #7965). Dev app `wizard-13448` (project 57907, repo `jaah-ai/app-dev-wizard-13448`) sits `failed` at `aws_lambda`. - Lambdas present: `ea-dev-ops`, `ea-main-ops`, `ea-db-init`, `ea-dev-t13447-python`, `ea-dev-wizard-13448`. ## What to do (verification; fix only a defect you find) 1. Re-read the quota. If still below what two apps need, ask the operator ONCE (AskUserQuestion, header `External`) whether they can get AWS to approve the case; if not cleared, settle naming every oracle below as blocked. 2. Once granted: Retry app `wizard-13448` (AC-9 Retry), and create one Python-template app; for each template push to `main` → deploy green; `curl -i https://<slug>.dev.apps.jaah.ai/` 200 HTML and `/api/health` 200 with a DB round-trip; keyless function URL → 403 (AC-11/AC-24). Panel shows address and last deploy (time, short sha, result). 3. AC-12: run the `isolation-probe` workflow (Task 13447's artifact `isolation-probe.yml`) from app A against B: S3 put, `lambda update-function-code`, ECR push/pull, and ops `probe_connect` all denied; cite verbatim. 4. AC-17: operator Pause/Unpause from the customer Easy Mode tab; `curl` both URLs reflect each ("paused by operator"). 5. AC-15/AC-16: set the org's request-cap override small, generate traffic, operator "Run now" `hosted-app-usage` → panel numbers move; paused page "over limit" on `/` and `/api/*`; exactly one notice per Owner/Admin; Unpause → live. 6. AC-18: sponsorship end today+7 → one warning; in the past → paused "sponsorship ended", `sponsored_expiry` ledger entry, Jaah AI page shows the two choices; shared node still live. Restore the date afterwards. 7. AC-19: hand over a throwaway app to `ruzhukov-genai`; a later push fails at assume-role; URL still serves. 8. AC-23: delete a throwaway Easy Mode project with the typed address → URL stops serving, AWS resources gone, repo kept, slug offered again. Out of scope: the live console (`<slug>.apps.jaah.ai` on main) — it waits for promotion to master, a human gate; the per-app concurrency design; AI runs on the shared node (separate follow-up). Done means: - Every oracle above cited with dev evidence (curl output, screenshots desktop + phone for panel states) in the report. - Any defect found fixed via a PR merged through the lane with Jaah Deploy green; otherwise settle no_pr with the evidence. - Throwaway apps cleaned up; `wizard-13448` left live or deleted, said which.