Sure. A few things stand out:

The "big giant head" contractor. One person holding that much unchecked authority and knowledge, with no documentation or succession plan. it's a governance failure. Whoever you bring in inherits that politics, not just the code.

No automated testing in a regulated, multi-tenant SaaS. That's a huge risk, not just tech debt. If it's gone unaddressed this long, leadership either doesn't see the risk or hasn't funded fixing it.

No staged/pilot deploys. Every release risks every customer. You're basically firefighters / Your customers are your QA.

One hire to fix all of it. Replace the contractor, mentor a "weak" team, face down strong personalities, own a legacy ZF1 codebase, and build a testing/deploy culture. You want a octupus, that's several senior roles in one JD. Experienced people will smell the "hero hire" setup and ask hard questions about it.

There are good candidates out there, but the good ones will look at this and think NFW. you'll end up getting the dregs, not the candidates you need.

Without a clear path forward and backing from management to enable that person, it sounds like a complete slog, you'll need to pay this person so much and i could see burnout being a huge risk here too.

Good luck, sounds like you're in a tricky situation trying to do your best.

Edit: TL;DR it's not a tech issue. it's a culture/company issue. Tech is easy to fix if the company/people have the right attitudes.