test(deploy): assert production helm upgrade keeps --atomic (BLO-21492)

[allyblockcast]

Thinking Path

• ci(deploy): make production helm upgrade atomic (BLO-21492) #998 added --atomic to the production helm upgrade invocation so a resource denied mid-upgrade (e.g. by an admission policy, per BLO-21492) rolls the whole release back instead of leaving the worker and API tiers on different image digests.
• Ally's final review on ci(deploy): make production helm upgrade atomic (BLO-21492) #998 (head cde07e50) approved the merge but flagged a real gap as a non-blocking suggestion: scripts/check-docker-deploy-timeout.test.js only asserts the numeric --wait --timeout margin, not that --atomic itself is present — a future edit could drop the flag and no test would catch it.
• ci(deploy): make production helm upgrade atomic (BLO-21492) #998 has since merged (f3e120d8), so this is a fast follow-up closing that suggestion rather than a change to ci(deploy): make production helm upgrade atomic (BLO-21492) #998 itself.
• This PR adds one assertion that the production helm upgrade invocation still passes --atomic, scoped to the exact upgrade call (not a loose substring match elsewhere in the job).

Linked Issues or Issue Description

Follow-up to Blockcast/paperclip#998, refs BLO-21492. No new GitHub issue — same tracker issue, addressing a review suggestion left open on the merged PR.

• I searched the GitHub PR list (open + recently closed) for similar PRs and confirmed this is not a duplicate.

What Changed

• Added a test in scripts/check-docker-deploy-timeout.test.js asserting the production helm upgrade "${RELEASE}" invocation retains --atomic between the helm upgrade call and where helm_pid=$! captures its PID (i.e. on the actual upgrade command, not just anywhere in the job).

Verification

• node --test ./scripts/check-docker-deploy-timeout.test.js — 13/13 pass (was 12; new test included).
• Manually verified the new assertion actually fails: temporarily stripped --atomic from .github/workflows/docker.yml locally, reran the test suite, confirmed the new test fails with the expected message, then reverted (not committed).

Risks

None — test-only change, no workflow behavior modified.

Model Used

Claude, claude-sonnet-5[1m] (Sonnet 5, 1M context), via Claude Code — no extended thinking mode, standard tool use.

Checklist

• I have included a thinking path that traces from project context to this change
• I have specified the model used (with version and capability details)

[allyblockcast]

🔗 Paperclip issue: BLO-21492

[allyblockcast]

🔗 Paperclip issue: BLO-21492

[kkroo]

Superseded by #1099, which carries the exact same head under independent PR author kkroo so Ally can provide the required App approval.