Fix notification bridge deployment annotations

[ael-dev3]

Summary

• omit the Cloudflare-owned deployment trigger annotation from B0 and prepared deployment requests
• require the server-returned deployment trigger during exact postflight attestation
• add success and fail-closed regressions, then refreeze the 956-member source closure and protected workflow pins

Verification

• B0 release suites: 67 passing
• prepared runtime, adapter, receipt, and release projection suites: 86 passing
• Greater Realm release-boundary suites: 17 passing
• TypeScript typecheck
• production build and asset/public-boundary validation
• B0 and prepared static policy verifiers
• canonical source-closure verifier
• sealed-launch preparation and Greater Realm release gates
• three independent no-blocker reviews

No production mutation is performed by this pull request.