test(generate): fill correctness-census followup assertions

[joshua-temple]

Problem

The generation-correctness census classifies every emitted-affecting manifest field as either a named correctness assertion or a reviewed marker. It shipped with a set of followup markers: fields with a distinct emitted semantic shape whose assertion was deferred. A followup is a tracked acknowledgment, not a silent skip, but it still leaves the field's emitted contract unpinned.

Fix

Fill the followup entries with real assertions (each proven red-first by breaking the emitter and watching the assertion fail):

• gpg_key_id / gpg_key_secret (security-critical): pin that the emitted git setup imports the private key, sets commit.gpgsign true, and wires user.signingkey. A dropped signing line reds the assertion, so a regression cannot silently ship unsigned commits.
• run_policy (builds / deploys / validate): the emitted if: gate matches the policy (change-detection gate vs always()).
• depends_on / optional_depends_on (build + deploy): required deps both sequence (needs:) and gate (if:); optional deps only sequence.
• environments role: role: release moves the release stage off the positional-last environment.
• pin_mode: sha mode emits SHA refs, tag mode emits tag refs.
• release_trigger: dispatch drops the push: trigger.
• reconcile.commit: append vs followup emit their distinct steps.

Honestly reclassified rather than asserted:

• reconcile.source: not-emitted. It has a single valid value and no emitted consumer in the generate package, so there is no distinct shape to pin.
• external[].deploys[].optional_depends_on[]: kept followup. The same-repo optional contract is now asserted, but the external-deploy emit path is distinct and not exercised here.

Also adds a positive deploy-side permissions case: a configured deploy permission is asserted to emit, not only the least-privilege omission (reviewer nit from the prior PR).

Where a field's correctness has a runtime component (run_policy gating, depends_on skip behavior), the assertion pins the emitted shape and notes that the runtime proof is fleet-only.

Verification

• go build ./..., go vet, golangci-lint run ./...: clean.
• go test ./...: green except the documented TestPushWithRebaseRetry_FailsFastOnRemoteRejection flake.
• go test ./internal/generate/ -race: clean.
• cascade verify --own-repo: no drift.
• Census followup markers drop from 14 to 1; the census still forces a new field and every touched field stays classified.
• Each assertion proven red-first by mutating its emitter.