ci: add protected production-ref recovery

[Codevena]

Problem and outcome

Adds a manual, non-deploying recovery path for the protected coolify-production ref before the CI-gated Coolify cutover proceeds. Recovery is available only while COOLIFY_CD_ENABLED is exactly false, validates the repository and current main SHA before reading App credentials, shares the deploy concurrency group, and never calls Coolify.

The dependency-free controller updates an existing ref non-force or creates it only after an exact HTTP 404, then verifies the final ref. A unique sentinel keeps an HTTP 404 distinct from a successful invalid JSON null payload.

Compatibility, security, and migrations

No A2A, MCP, API, database, or runtime migration changes. The workflow has no Coolify or Cloudflare credentials and mints a short-lived GitHub App token only after secretless validation. Native Coolify auto-deploy remains active and the new CD path remains disabled during this PR.

Verification

• Regression test added or an explanation provided
• Lint, typecheck, and relevant tests pass
• Docs/release notes updated for public contract changes
• No credentials, personal data, local paths, or agent-only instructions added

Commands and results:

pnpm lint                                      PASS
pnpm typecheck                                  PASS
pnpm test                                       PASS (40 files, 501 tests)
pnpm build                                      PASS (48/48 pages)
actionlint                                      PASS
git diff --cached --check                       PASS
recovery guard mutation checks                  PASS (9/9 killed)
independent reviews                             PASS / PASS