Prevent native deploy bypass in CI mode

[davejohnson]

What changed

• Add a generic tri-state observation contract for provider-native repository sources: connected, disconnected, or unknown.
• Plan provider-native source reconciliation as an explicit service action when deploy.trigger: "ci" is selected.
• Fail closed when source state cannot be proven, and make CI workflow/applied-spec actions depend on source reconciliation.
• Add Railway support for observing the live source and disconnecting it with serviceDisconnect.
• Clear cached source bindings only after the provider confirms the reviewed service ID was disconnected.
• Add planner, apply, observation, adapter, fingerprint, and end-to-end contract coverage.

Why

A Railway service could retain its native GitHub integration while Hypervibe also managed a CI deployment workflow. A push to main could therefore deploy outside explicit CI promotion, and staging could receive duplicate native and CI deployments, while Hypervibe incorrectly reported the environment as in sync.

The planner/provider contract is portable. Railway declares automatic disconnect support now; other platforms can opt into automatic disconnect or declare a blocking/manual policy through provider metadata.

Safety

• Unknown provider observation blocks instead of being interpreted as disconnected.
• The disconnect is its own persisted plan action and mutates only the durable provider service ID reviewed in that action.
• No-op actions make no provider mutation.
• Downstream CI and applied-spec actions cannot proceed after a blocked or failed source reconciliation.

Validation

• npm test — 109 files, 922 tests passed
• npm run typecheck
• npm run build
• git diff --cached --check