ci: update TESTING.md

TESTING.md

@@ -140,6 +140,25 @@ tests\run-tests.cmd http://localhost:8085/run-all.asp
 - Re-running the suite produces stable results.
 - The production site under `public/` still exposes no test runner pages or test routes.
 
+## Deployment verification gate
+
+Before a production release:
+
+1. Run the full ASPUnit suite in the isolated development IIS application.
+2. Parse every repository `web.config` as XML.
+3. Parse both deployment scripts with the Windows PowerShell parser on a Windows CI worker.
+4. From a clean standalone checkout of the approved branch, run:
+
+   ```powershell
+   .\scripts\deploy-iis-git.ps1 -SiteName 'ttasp' -RemoteTarget 'webserver-1' -DryRun
+   ```
+
+   This validates and packages locally but makes no network connection.
+5. Run `-RemotePreflightOnly` as a separately approved step when host connectivity is permitted.
+6. After deployment, require the installer smoke test and then run any production-safe HTTP checks. Never expose the `tests/` IIS application in production.
+
+Linux can validate XML and inspect script structure, but cannot prove Windows PowerShell, WebAdministration, Classic ASP, IIS URL Rewrite, Access/ACE, SSH elevation, or live HTTP behavior. Those checks remain Windows/IIS gates.
+
 ## Limitations
 
 - This harness runs only inside IIS/Classic ASP; it is not intended for Linux execution.