ci: gate Coolify deploys on verified revisions

[Codevena]

What changed

• admit deployments only after successful main CI runs
• pin a ruleset-protected coolify-production ref to the verified SHA via a dedicated GitHub App
• queue Coolify through the HMAC-signed manual GitHub webhook with after bound to that SHA
• poll with a separate read-only Coolify token and fail closed on target drift, malformed responses, timeouts, status failures, or commit mismatch
• run the production MCP/A2A smoke only after the exact deployment finishes

Why

Coolify native auto-deploy currently deploys main pushes before GitHub CI completes. The previous GitHub workflow also treated missing deployment credentials as a successful skip. Coolify's deploy API has no commit parameter, so the signed manual webhook is used to bind the queued deployment to the verified SHA.

Cutover safety

COOLIFY_CD_ENABLED is already set to false. Merging this PR therefore does not access production deployment secrets or queue a CI-controlled deploy. Native Coolify auto-deploy remains enabled until the replacement path is configured and proven end to end.

Verification

• lint and typecheck
• production build: 48/48 pages
• Vitest: 39 files, 488/488 tests
• actionlint and diff check
• mutation checks: 88/88 killed
• two independent final reviews: PASS