[Paulo Lacerda (placerda)]

Changed

• Export the deployed application's actual KEY_VAULT_URI from the foundation, gated by deployKeyVault, without hardcoding cloud DNS suffixes.
• Pass the URI and APP_CONFIG_TLS_COMPATIBILITY to the bundled Hosted container; the TLS control defaults to false.
• Add an offline deployment contract regression and an Unreleased changelog entry.

Coordinated runtime corrections

• Fix Hosted invocation compatibility and classic history registration agent-app-ui#147: Invocations api-version=v1, canonical/legacy conversation identifier compatibility, and classic history registration only for the classic backend.
• Fix configuration label isolation and add opt-in verified TLS bootstrap agent-app-orchestrator#404: explicit null-label selection and opt-in endpoint-scoped verified TLS transports for App Configuration and Key Vault.
• Document coordinated Hosted runtime recovery corrections AI-Landing-Zones#155: central operator documentation, availability caveats and rollback guidance.

Local validation

• 39 foundation/release/output contract tests passed.
• Bicep build and lint passed with existing warnings; compiled size 4.484 MB passes the existing 4.7 MB release gate.
• UI: 566 tests passed, including an installed non-editable wheel; all five quality checks passed.
• Orchestrator: 26 focused tests passed; new transport typing/lint and architecture pass. Its existing quality-bootstrap debt is unchanged; the new ownership record requires independent maintainer review. Broader strategy characterization remains blocked by existing SDK model-import incompatibility, not claimed as passing.
• Documentation strict build passed.
• Azure environment validation and deployment were intentionally omitted, as requested. The accepted demo environment was not changed.

Compatibility and integration

The flag remains disabled by default and does not alter certificates, identities, RBAC, document authorization or global TLS. This PR does not publish images or releases and does not change component pins. Enabling the profile requires an orchestrator image containing the companion fix; a later validated coordinated release must bind the component versions in the manifest.

Related to #695.