You may need to change how you are accessing the servlet, Please see this - https://sling.apache.org/documentation/the-sling-engine/servlets.html#example-registration-by-resource-type-etc

this happened with me once, in my case the custom tags were defined in a shared library jar that was deployed saparately and happened to be missing from publish. you may want to track down which files provide support for your custom tags and make sure they are available in publish.

Not sure if this would work but looks like you can extend /libs/cq/replication/components/agent to create a custom replication agent.

just trying to understand your use case - if your content is mostly static, why would you use a complex system like AEM to serve it? why not use something like tomcat. you can build a kind of framework in java/jsp to provide limited editing capabilities.

If I am not wrong accessing osgi config from javascript would essentially require user to have access to felix console. in most cases authors will not have that priviledge.

did you try putting 403.jsp in sling/servlet/errorhandler as suggested in the first link? what was the outcome?

I dont think dispatcher allows application/contextpath specific config for renderer. in this case it simply connects to tomcat.

when and how it started? can you paste a snap of error.log when login url is accessed?