Restructure navigation UX: sidebar groups, route aliases, and phase 3-6 polish

Sidebar (phases 1-4, committed in parent sprint):
- Dashboard childless; Releases gains Health child
- Operations moved to release-control group with 8 promoted children
- Evidence renamed to Audit; Logs/Bundles as canonical sub-items
- Setup Notifications removed (consolidated)

Route fixes and canonical restore (Sprint 030):
- releases.routes: /health loads EnvironmentPosturePageComponent;
  /environments and /environments/:environmentId kept as canonical Releases routes
- legacy-redirects: release-orchestrator/environments and
  release-control/environments both redirect to /releases/environments
- app.routes: release-control/{environments,regions} alias → /releases/environments
- route-surface-ownership spec updated to match canonical Releases paths
- live-route-surface-ownership-check expected paths aligned

Phase 3: Remove in-page "Create Hotfix" button from hotfixes-queue component;
  topbar action is the sole create affordance.

Phase 6 UX polish:
- security-reports-page: stub link-list → tabbed layout (Risk, VEX, Export)
- filter-bar: Search button + Enter key trigger; top-row / filter-row layout
- approvals-inbox: horizontal chip-style status filters replacing pill buttons

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/Web/StellaOps.Web/scripts/live-route-surface-ownership-check.mjs

@@ -246,17 +246,17 @@ async function main() {
     },
     {
       path: `/releases/environments?${scopeQuery}`,
-      expectedPath: '/ops/operations/environments',
+      expectedPath: '/releases/environments',
       expectedTitle: /environments/i,
     },
     {
       path: `/release-control/environments?${scopeQuery}`,
-      expectedPath: '/ops/operations/environments',
+      expectedPath: '/releases/environments',
       expectedTitle: /environments/i,
     },
     {
       path: `/setup/notifications?${scopeQuery}`,
-      expectedPath: '/ops/operations/notifications',
+      expectedPath: '/setup/notifications',
       expectedTitle: /notifications/i,
     },
     {