Restructure navigation UX: sidebar groups, route aliases, and phase 3-6 polish

Sidebar (phases 1-4, committed in parent sprint):
- Dashboard childless; Releases gains Health child
- Operations moved to release-control group with 8 promoted children
- Evidence renamed to Audit; Logs/Bundles as canonical sub-items
- Setup Notifications removed (consolidated)

Route fixes and canonical restore (Sprint 030):
- releases.routes: /health loads EnvironmentPosturePageComponent;
  /environments and /environments/:environmentId kept as canonical Releases routes
- legacy-redirects: release-orchestrator/environments and
  release-control/environments both redirect to /releases/environments
- app.routes: release-control/{environments,regions} alias → /releases/environments
- route-surface-ownership spec updated to match canonical Releases paths
- live-route-surface-ownership-check expected paths aligned

Phase 3: Remove in-page "Create Hotfix" button from hotfixes-queue component;
  topbar action is the sole create affordance.

Phase 6 UX polish:
- security-reports-page: stub link-list → tabbed layout (Risk, VEX, Export)
- filter-bar: Search button + Enter key trigger; top-row / filter-row layout
- approvals-inbox: horizontal chip-style status filters replacing pill buttons

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

docs/implplan/SPRINT_20260310_030_FE_releases_environment_canonical_route_restore.md

@@ -0,0 +1,49 @@
+# Sprint 20260310_030 - FE Releases Environment Canonical Route Restore
+
+## Topic & Scope
+- Restore `/releases/environments` as a canonical Releases route instead of redirecting it into Operations.
+- Keep the working topology-backed environment inventory UI, but mount it directly under Releases so the live route contract matches the product shell.
+- Realign legacy environment aliases and live route-ownership evidence with the restored canonical route.
+- Working directory: `src/Web/StellaOps.Web/src/app/routes`.
+- Allowed coordination edits: `src/Web/StellaOps.Web/src/app/app.routes.ts`, `src/Web/StellaOps.Web/scripts`, `docs/implplan/SPRINT_20260310_030_FE_releases_environment_canonical_route_restore.md`.
+- Expected evidence: focused Angular route tests, rebuilt web bundle, live Playwright canonical/ownership checks.
+
+## Dependencies & Concurrency
+- Depends on the current live compose stack and the prior route-ownership cleanup sprint.
+- Safe parallelism: do not revive the dead release-orchestrator environment pages in this slice; keep the fix bounded to route contracts and evidence.
+
+## Documentation Prerequisites
+- `AGENTS.md`
+- `docs/qa/feature-checks/FLOW.md`
+- `docs/implplan/SPRINT_20260310_028_FE_route_surface_ownership_alignment.md`
+
+## Delivery Tracker
+
+### FE-RELEASE-ENV-001 - Restore canonical Releases ownership for environment inventory
+Status: DOING
+Dependency: none
+Owners: QA, 3rd Line Support, Product Manager, Architect, Developer
+Task description:
+- Live Playwright canonical sweeps still report `/releases/environments` as a failure because the route hard-redirects to `/ops/operations/environments`, even though Pack 22 and the current canonical sweep both treat `/releases/environments` as the client-facing contract.
+- The old release-orchestrator environment pages are not safe to restore: they are placeholder-heavy, contain stale links, and would reintroduce broken actions. The correct fix is to keep the working topology-backed inventory/detail pages and mount them directly under Releases.
+
+Completion criteria:
+- [ ] `/releases/environments` and `/releases/environments/:environmentId` resolve under `/releases/*` without redirecting to Operations.
+- [ ] Legacy release environment aliases redirect to `/releases/environments`.
+- [ ] Route ownership specs and live ownership harness match the restored contract.
+- [ ] Rebuilt live web passes the canonical route sweep with zero failed routes.
+
+## Execution Log
+| Date (UTC) | Update | Owner |
+| --- | --- | --- |
+| 2026-03-10 | Sprint created after the live canonical Playwright sweep dropped to a single failure: `/releases/environments` redirected to `/ops/operations/environments`. Root-cause audit confirmed the redirect was architectural drift, not a component/runtime failure. | Developer |
+
+## Decisions & Risks
+- Decision: supersede the earlier Operations-only redirect decision from `SPRINT_20260310_028_FE_route_surface_ownership_alignment.md`; the canonical Releases contract wins because the live route matrix and Pack 22 both depend on `/releases/environments`.
+- Decision: do not revive `features/release-orchestrator/environments/**` in this slice. Those components remain non-canonical and need separate revival work if they are ever to return.
+- Risk: the route-ownership Playwright harness still contains stale expectations for `/setup/notifications` and release environment aliases. It must be updated together with the route change or it will produce false failures.
+
+## Next Checkpoints
+- Land the Releases route and legacy alias contract update.
+- Re-run focused Angular route tests.
+- Rebuild/sync the web bundle and re-run the live canonical and route-ownership sweeps.