Deploy AWS side only; Fusion is SaaS. Point to /tokenize+/restore tasks

scripts/deploy.sh

@@ -1,5 +1,7 @@
 #!/usr/bin/env bash
-# One-pass-ish deploy. Assumes aws-cli is configured (creds + region) and docker,
+# One-pass-ish deploy of the AWS side. Fusion is shared SaaS and is NOT deployed
+# here -- it is configured in its console (fusion/POLICY_SETUP.md) to call the
+# endpoints this stack exposes. Assumes aws-cli (creds + region), docker,
 # terraform, and the AgentCore CLI are installed. Review before running.
 set -euo pipefail
 cd "$(dirname "$0")/.."
@@ -19,8 +21,7 @@ aws ecr get-login-password --region "$REGION" | docker login --username AWS --pa
 docker build -t "$ECR/hncb-presidio:latest" ./presidio
 docker push "$ECR/hncb-presidio:latest"
 
-echo "==> Step 3: full apply (ECS services for Fusion + Presidio)"
-echo "    Make sure fusion_image_uri is set (you supply the Axway image)."
+echo "==> Step 3: full apply (Presidio Fargate service + tables)"
 terraform -chdir=terraform apply \
   -var "presidio_image_uri=$ECR/hncb-presidio:latest" \
   -auto-approve
@@ -36,7 +37,8 @@ export REGION
 bash scripts/agentcore_setup.sh
 
 echo ""
-echo "Remaining manual steps:"
-echo "  - Configure Fusion ingress/egress policy  -> fusion/POLICY_SETUP.md"
-echo "  - Point ui/index.html GATEWAY_URL at the Fusion host, then host it (S3/CloudFront or local)"
+echo "Remaining steps (see CLAUDE.md task backlog):"
+echo "  - Build the /tokenize + /restore HTTPS endpoints Fusion SaaS will call (T1, T2)"
+echo "  - Configure the shared Fusion SaaS instance -> fusion/POLICY_SETUP.md"
+echo "  - Point ui/index.html GATEWAY_URL at the Fusion SaaS entrypoint, then host it"
 echo "Done."