fix(generate): close four silent generated-output defects

[joshua-temple]

Four defects that each emit valid YAML doing the wrong thing (actionlint alone will not catch them). Each has a generation-assertion test that reds on the pre-fix output and greens after. Verified by generating and reading the emitted YAML.

GB2 (blocker) - promote matrix deploys dropped environment/sha

A matrix deploy (a deploy declaring inputs) emitted a with: block carrying only declared manifest inputs, while its job name referenced ${{ matrix.environment }} - a key the matrix builder never set. The deploy ran with an empty environment.

Before:

  deploy-web:
    name: Deploy web (${{ matrix.environment }})
    with:
      region: ${{ matrix.region }}

After:

    with:
      environment: ${{ matrix.environment }}
      sha: ${{ matrix.sha }}
      region: ${{ matrix.region }}

The matrix builder now injects {environment, sha} onto every entry; environment is passed unconditionally (orchestrate's contract), sha only when the callback declares it, and neither when the manifest already wires it as an explicit input.

GM4 (major) - rollback repository_dispatch dry_run truthiness

(inputs.dry_run || client_payload.dry_run) != 'true' compared a JSON boolean true (a natural {"dry_run": true} payload) against a string; GitHub Actions coerces numerically, so the guard read true as not-a-dry-run and a dry-run rollback ran real deploys and wrote rolled-back state.

Before: ... != 'true' && (...)
After: (...) != true && (...) != 'true' && (...) - matches both the boolean and the string. Without the trigger, output is byte-identical.

GM5 (major) - dependent deploys judged the immutable base result

deploy-api depending on deploy-web gated on needs.deploy-web.result == 'success' (and emitted it twice). A GHA job result is immutable, so a base deploy failing-then-rescued by a retry shim left the dependent skipped.

Before:

    if: |
      needs.deploy-web.result == 'success' &&
      needs.deploy-web.result == 'success'

After (retries: 2):

    if: |
      (needs.deploy-web.result == 'success' || needs.deploy-web-retry-1.result == 'success' || needs.deploy-web-retry-2.result == 'success')

Reuses #627's effectiveSuccessCond (not duplicated); the duplicated clause is removed. N=0 collapses to the single bare clause.

GM6 (major) - promote native Deployment had no dry_run guard

A dry-run promote created a real GitHub Deployment, and the status expression counted a legitimately skipped deploy as failure and omitted the prod job.

Before:

      - name: Create deployment
        if: ${{ github.server_url == 'https://github.com' }}
      ...
      if [ "${{ (needs.deploy-app.result == 'success') && 'success' || 'failure' }}" = "success" ]

After:

        if: ${{ github.server_url == 'https://github.com' && github.event.inputs.dry_run != 'true' }}
      ...
      if [ "${{ ((needs.deploy-app.result == 'success' || needs.deploy-app.result == 'skipped') && (needs.deploy-app-prod.result == 'success' || needs.deploy-app-prod.result == 'skipped')) && 'success' || 'failure' }}" = "success" ]

Verification

• go build/test/vet/-race and golangci-lint clean; cascade verify --own-repo no drift.
• The fix(generate): enforce emitted-workflow validity; reject on_failure continue, gate hotfix inputs #631 actionlint feature-matrix guard stays green (emitted output valid).
• e2e scenarios: 43 (GB2 with-block), 32 (GM4 dual-comparison), 31 (GM6 dry-run guard) assert the fixes structurally on act. The empty-env deploy, boolean-payload dry-run, retry-rescued dependent, and dry-run-creates-Deployment behaviors are only observable on real GitHub (the fleet).