Fail closed before staging-only administrative writes

Run one-off staging administration only in an environment that injects credentials without printing them. Before any write, fail closed unless the runtime environment is exactly staging, every API and database project identifier resolves to the same staging project, and that project differs from production.

For identity provisioning, verify the authentication identity, application profile, and authorization grant independently, because application authorization may join through a profile rather than directly from authentication. Use a separate read-only readback.