Enable public listing compression and selective log retention in production - #1799

Enable negotiated gzip for credential-free public listing responses and 10% retention of fast successful listing access logs, using the implementation in #1798. Preserve errors, slow reads, retries, authentication and publishing routes, audit logs and unsampled metrics. Application templates, cache lifetime, database resources and capacity remain unchanged.

Document the narrowly scoped deployment role needed to manage this exclusion. The existing deployment service accounts have only get/list/create/update exclusion permissions through that additional role; no log or bucket deletion permission is added.

Validation: live staging encoding, identity fallback and decoded-content checks passed; bounded read probes, CPU/throttling checks and service health passed. A later sample after log-router propagation confirmed selective retention. Repository CI and the exact-head production saved-plan preview passed; the plan permits only the ingress ConfigMap, its in-place update provider setting and the named exclusion. Detailed evidence remains private.