feat: complete Epic 1 production foundation

docs/capability-baseline/required-surfaces.json

@@ -1,11 +1,12 @@
 {
-  "baseline_version": "2026.08.14.4",
+  "baseline_version": "2026.08.24.1",
   "required_flow_ids": [
     "api-agent-catalog",
     "api-approvals",
     "api-auth-profiles-upstreams-secrets",
     "api-auth-workspace",
     "api-canonical-request-trace-identity",
+    "api-master-key-identity-rotation",
     "api-typed-metrics-foundation",
     "api-logs-usage",
     "api-mcp-approval-keys",
@@ -25,7 +26,9 @@
     "ui-operation-import-export",
     "ui-operation-lifecycle",
     "ui-operation-test",
-    "ui-usage"
+    "ui-usage",
+    "api-onboarding-first-call",
+    "ui-onboarding-first-call"
   ],
   "surface_groups": [
     {
@@ -61,7 +64,8 @@
     {
       "flow_ids": [
         "ui-auth-profiles-upstreams-secrets",
-        "api-auth-profiles-upstreams-secrets"
+        "api-auth-profiles-upstreams-secrets",
+        "api-master-key-identity-rotation"
       ],
       "id": "credentials"
     },
@@ -97,6 +101,13 @@
         "mcp-scoped-tool-search"
       ],
       "id": "mcp-tools"
+    },
+    {
+      "flow_ids": [
+        "api-onboarding-first-call",
+        "ui-onboarding-first-call"
+      ],
+      "id": "onboarding"
     }
   ]
 }