Combined ROSS adaptation batch

[github-actions]

Automated-Upstream-Mike-Sync: true
Upstream-Risk: medium

Applies PR Open-Legal-Products#273’s behavior-preserving JSON middleware cleanup. All other entries are deferred due to protected boundaries, incompatible test infrastructure, or insufficient bounded validation.

Classified upstream items

• Mike PR [Security 1/9] SSRF guardrails for server-side connector fetches Open-Legal-Products/mike#242: defer — High-risk SSRF/OAuth security-boundary change. ROSS has divergent MCP egress code and lacks the supplied Vitest harness, so the complete adaptation cannot be validated safely.
• Mike PR Remove dead jsonLimitForPath abstraction Open-Legal-Products/mike#273: medium — Bounded backend cleanup: replaces a path-insensitive wrapper with one equivalent static JSON parser while preserving ROSS’s 50 MB limit.
• Mike PR [Testing 17] test(backend): document-integrity unit tests + ratchet raise Open-Legal-Products/mike#253: defer — ROSS lacks the upstream backend Vitest/coverage harness, and several Mike-specific assertions require speculative adaptation.
• Mike PR [Testing 18] test(frontend): API-client/SSE tests + coverage ratchet Open-Legal-Products/mike#255: defer — Depends on an absent frontend test harness and includes prohibited workflow changes; a reliable partial adaptation is unclear.
• Mike PR feat: content hashes on document versions + signed project export manifest Open-Legal-Products/mike#279: defer — High-risk schema migration, cryptographic signing-key, export, and production-data-boundary change with too broad a blast radius for this batch.
• Mike PR feat: add workflow slash triggers Open-Legal-Products/mike#280: defer — The cross-stack UI/API feature is not adequately testable because ROSS lacks the supplied frontend test harness.

Automated qualification

The complete engineering gate and Fly container preflight passed before this PR was opened. Exact-head Baseline remains required before merge.