fix: invoke scalar deploy without subcommand

[hseshadr]

Summary

• remove the invalid trailing sync from the scalar deploy invocation
• add a fail-closed workflow mutant that prevents terminal subcommands from returning
• preserve the exact protected run, secret, environment, and provider boundaries

Incident evidence

Exact-main deploy run 33285975502 failed during CLI argument parsing with unknown command "sync" for "dagger call deploy". Parsing stopped before the deploy function or provider transport executed.

Verification

• RED: focused workflow contract failed only the committed deploy job
• GREEN: focused workflow contracts 24/24
• Foundation/deployment/workflow contracts 82/82
• actionlint
• zizmor 1.29.0 targeted + full
• dagger develop
• real generated deploy help verifier
• cached dagger call contracts stdout
• independent review: Ready Yes, no P0-P3 findings

No deploy, provider, environment, or secret mutation was performed.