release: encode the service dependency graph as helmfile needs: edges

Deployment ordering in deploy/stacks/self-managed/helmfile.d/ currently rests almost entirely on stage-file filename sort order plus the helmfile version pin in Makefile.dist, not on declared dependencies. Very few of the real service dependency edges are expressed as needs:.

This matters most for destructive migrations: dropping a column is safe for a customer skipping many versions provided the migration Job completes before the services that read that column start. That is a deployment-ordering guarantee, not an upgrade-path one, and it is the guarantee currently not being made.

Note that needs: sequences releases, not pod readiness — without waiting on rollout there can still be a window where a dependent calls an endpoint its prerequisite is not yet serving.

Blocked on #1981.