feat: reserve gitops deploy target branch and sha-tracking fields

[joshua-temple]

Problem

Issue #2 asks to reserve a cross-repo GitOps deploy-target shape before the v1 manifest schema freezes. A literal new gitops_targets: block would duplicate and orphan the already-reserved deploy_target block (modes dispatch|gitops), whose doc-comment promises it is the GitOps-mirror home.

Fix

Converge onto the existing deploy_target block (no new key). Additive, shape-only, no generator output, no schema_version bump:

• DeployTarget.Branch (branch,omitempty) and DeployTarget.TrackSHA (track_sha,omitempty), both reserved and meaningful only when mode: gitops.
• Reserved per-env state slot DeployState.TargetSHA (target_sha,omitempty), mirroring the external-deploy SHA concept; state structs are not part of the JSON schema.
• validateDeployTarget now rejects track_sha/branch under mode: dispatch and rejects an unsafe branch ref (leading/trailing slash or whitespace).
• JSON schema deployTarget definition gains branch/track_sha; all three on-disk copies regenerated byte-identical via cascade schema.
• Docs: external: guidance now points at deploy_target{mode: gitops} for the GitOps mirror; a new reserved-shape section in versioning.md.

Verification

• go build ./cmd/... ./internal/..., go test ./... (1487 pass), golangci-lint run ./... (0 issues), e2e go build+go vet clean.
• New byte-identity generator test (populated vs empty, output > 1KB) plus the existing TestPlan_MatchesGeneratedBytes stay green: generated bytes are identical with and without the new fields.
• New validation table tests and a schema-version round-trip test (validates at CurrentSchemaVersion, no bump).
• New e2e scenario 24-gitops-deploy-target-reserved.yaml parses/validates and proves regeneration drift-free (verify exit 0).

Closes #2