arch: keep extension points open for future GH Deployments + Environments REST sync

[joshua-temple]

Problem

GH Deployments API emission and a sync environments subcommand (env reconciliation via REST: required reviewers, branch policy, wait timers, env-scoped secrets) are out of initial scope.

However, the natural hook points — finalize steps that already touch per-env state, and the manifest's environments list that already enumerates targets — should not be designed in a way that forces a refactor when these are added later.

Proposed

Design constraint (doc-only issue, no implementation). When working on coverage issues:

• Keep the finalize step's per-env exit point a single function — not inlined into the generated workflow YAML — so a future Deployments API call can attach without changing the generated workflow shape.
• Keep the environments list in the manifest as the single source of truth for env names. Don't fan it into multiple list fields that a future sync environments command would have to consolidate.
• Per-env config (the gha_environment: field, future required-reviewers, future deployment branch policy) lives under a single environments.<name>: block, not scattered across deploy entries.
• Document the seam in docs/architecture.md.

Acceptance

A doc-only PR naming the seam in docs/architecture.md is sufficient to close. PR reviewers flag any coverage work that violates the seam.

Impact

Preserves the option to add Deployments / Environments support in a future minor release without a breaking refactor. Costs nothing if we're disciplined now.