I have only one qualification for production code:

• Is someone going to complain if I take it down?

If the answer to that is yes, it's production. Often times, I point someone to one of my test servers, and they decide to send links to other people, suggesting it's available to use ... typically without informing me. Once I know they've done so, I can set up redirection and such back to a legitimate server. (if they send the URL to someone external, I typically find out, because there's the question of why they can't get past the firewall, but one of my test servers needs to have external access due to what's being tested on it, so 99% of my headaches come from that one)

...

As for the questions you ask -- the only checklist I have is 'signed off by the relevant stakeholders'. (and that includes the programmers). Some of the stuff I write is a whole 50-60 lines of code, and needs to be up within a day ... we don't go through heavy development on it, it's just that the stakeholders know there's a different level of work that went into it as compared to the larger systems we've deployed.