fix(pages): tolerate legacy empty deployment SHAs

[hseshadr]

Why

Cloudflare Pages legitimately returns historical Direct Upload rows with an explicit empty commit_hash. The provider parsed every history row as final evidence and stopped before upload.

What

• parse list rows through a separate strict history type accepting only empty or canonical lowercase 40-hex hashes
• promote only the exact full-SHA, exact created-ID row into final deployment evidence
• reject duplicate exact candidates and malformed history
• treat documented queued/build stages as pending, while failure/canceled/unknown remain fail-closed
• require a pathless canonical deployment URL

Proof

• provider gate: 136 passed, 94.36% coverage
• real TLS mock and cross-language root fixtures green
• Ruff, strict mypy, Xenon A, schema, and audit green
• independent review: Ready, no findings