Plan an HTTP to HTTPS migration without losing SEO rankings

I run [oldsite.com], an HTTP-only WordPress site ranking well in Google for
[industry/niche] keywords, and I need to move it to HTTPS using a free Let's Encrypt
certificate issued by [my host]. My biggest fear is a ranking drop or a chunk of pages
falling out of the index because Google treats http:// and https:// as different
properties.

Walk me through this migration in a way that protects existing rankings, covering what
a basic "just install a cert" guide skips:

1. Pre-cutover audit: find every place the http:// URL is hardcoded, not just visible
   links, but also serialized data in widget options and page builder JSON, theme
   customizer settings (logo/background image URLs), and any CDN or ad network script
   tag that verifies domain ownership against the http scheme specifically.
2. Cutover sequence: when to force HTTPS at the server/plugin level relative to running
   a serialized-data-safe search-replace, how to set up the 301 redirect from http to
   https without creating a redirect chain when combined with any existing www/non-www
   redirect, and where HSTS fits in (and why enabling it too early, before every asset
   loads securely, causes an unrecoverable-without-clearing-hsts browser lockout).
3. Search Console and Analytics: since Google Search Console treats http://oldsite.com
   and https://oldsite.com as separate properties, spell out exactly which signals
   (submitted sitemap, verified property, disavow file) need to be recreated under the
   new property, and how to confirm the transition without waiting weeks to find out
   rankings dropped.
4. Verification: how to catch mixed-content warnings that only show up on pages with
   serialized image galleries or embedded third-party widgets, not just the homepage.

For each risk, tell me the specific tool or query to check it with (not just "check for
mixed content") so I can verify before Google or a customer finds the problem first.