fix: preserve deployment failure evidence - #26

Summary

• install deployment evidence handling before build, dry-run, source-ref, and control-plane checks
• preserve valid failed evidence, exact exit codes, stage attribution, and the pre/post-secret mutation boundary
• reject malformed control-plane JSON before upload or secret mutation
• synchronize release and rollout docs with PR feat: ship protocol 3 and semantic browser elements #24, release PR release: version packages #25, workflow results, and the empty staging/production environment secret inventories

Context

Post-merge Deploy run 30883763461 reached the staging upload with no CLOUDFLARE_API_TOKEN. The upload correctly did not run, but the deployment wrapper queried prior state before installing its failure trap, so no failure evidence artifact was produced. The staging environment still needs a scoped token and runtime-secret provisioning; this PR fixes the repository-controlled evidence path only.

Verification

• pnpm typecheck
• pnpm test — 783 tests, including 9 deployment integration tests
• pnpm build
• pnpm exec changeset status --since origin/dev — no package bump
• bash -n on all changed deployment scripts
• independent clean-code, architecture, and QA review lanes: CLEAN

Release metadata

No changeset is required: this changes private deployment scripts, tests, and documentation only. Generated release PR #25 remains correctly scoped to @understudy/protocol@0.9.0 and @understudy/connector@0.6.0.

AI disclosure

Implemented and reviewed with Codex. The exact commands and independent review results are recorded above.