Attest the exact fail-closed canary deployment

[AyobamiH]

Purpose

Close the final observability gap exposed by the first production canary. Deployment run #79 succeeded, but the workflow stopped at Wrangler success and the public health payload still advertised the pre-publication-ledger contract.

Changes

• Target Wrangler's top-level production environment explicitly with --env="".
• Verify the deployed /healthz response after every production deployment.
• Fail unless the live Worker reports the exact requested Git SHA.
• Fail unless production remains allowlisted to 1-3 tenants with generation and provider dispatch disabled.
• Advertise the expected worker-claims-v1 and publication-ledger-v1 contracts without claiming the applied database schema was evaluated by the liveness endpoint.
• Extend health and canary workflow regressions.
• Record the schema-first production canary receipt and observation snapshot.

Live evidence already obtained

• Guarded deployment run: #79 / 34354662402
• Release SHA: 3a27a993742151a6558089c9ab0ade6b1a762ba4
• Cloudflare Worker version: 773bb17d-59ef-484d-ae74-2f7c004e3447
• Production migration head: 20260907055000
• Queue rows preserved: 148
• Historical held revisions preserved: 11 across five conflict groups
• Post-deployment active jobs, publishing rows, generation rows, publication intents and attempts: 0
• Jobs touched after deployment: 0
• Live social posts made by this rollout: 0

Safety boundary

This PR does not enable generation, provider dispatch, collectors, Reddit ingestion or any hosted publisher. It does not change Supabase data or schema. It improves deployment verification and corrects operational evidence only.

Base

Exact upstream main merge commit 3a27a993742151a6558089c9ab0ade6b1a762ba4.