Make automated deploy fixes fail closed

[davejohnson]

What changed

• require declared deployment-failure evidence before an automated repair agent runs
• capture evidence even when the deploy job fails by using an always()-guarded evidence job
• produce model-neutral diagnosis summaries and refuse unrelated/empty source patches
• retry only safe Railway read requests for transient network, 429, and 5xx failures
• classify Railway diagnostics from runtime errors instead of generated source text
• document the fail-closed repair contract and prevention rule

Why

PR 376 in HLS was opened after a transient Railway 503, but its failure-evidence
job was skipped and the repair agent continued with an empty evidence directory.
It then proposed an unrelated application change. The repair workflow must stop
when it cannot prove what failed, while provider adapters should absorb bounded
transient read failures without replaying deployment mutations.

Impact

Generated Railway and Cloud Run deploy workflows will reliably upload failure
evidence. Automated repair workflows will only run with their declared evidence,
will include the configured agent's diagnosis in any draft PR, and will create
no source patch when the evidence does not establish an application defect.

Verification

• focused Vitest: 5 files, 43 tests passed
• npm run typecheck
• npm run build
• git diff --check

Existing test changes

• updated the deployment workflow contract to require always() on
  failure-evidence collection, replacing the prior skipped-on-upstream-failure
  behavior
• made the Railway missing-service diagnostic fixture use actual runtime error
  lines, with replacement coverage proving generated source strings do not
  trigger false diagnostics