The note that Deprecation is a Structured Field Date (@1735689600) while Sunset stays an HTTP-date is the detail most write-ups skip, good to see it spelled out.
Two related bits from the RFCs that fit the staged plan: RFC 9745 allows the Deprecation date to be in the future, so the header can ship in stage one before the endpoint is formally deprecated, and Sunset can't be earlier than that date. RFC 8594 also registers a separate rel="sunset" link relation, so the retirement policy page and the migration guide (rel="deprecation") can be two different links.
On brownouts returning 429: a client with an adaptive rate limiter reads that as "slow down", backs off, succeeds on retry, and nobody notices. A distinct error code in the body, like the one in your middleware, is what makes it show up in the consumer's logs as something other than throttling.