Persist platform superusers across canonical cloud provision

## Problem

The canonical cloud provision renderer does not project `PLATFORM_SUPERUSER_EMAILS` into `api.env`. A production hotfix can grant platform-superuser access temporarily, but the next canonical provision regenerates `api.env` without it and silently removes the role.

## Expected behavior

- Deployment configuration has one validated, bounded, case-insensitively unique list of platform-superuser emails.
- Canonical provision writes that list to API runtime environment as `PLATFORM_SUPERUSER_EMAILS`.
- Existing deployments that omit the optional list remain valid and fail closed.
- Tests prove projection and duplicate rejection without printing unrelated secrets.

Production incident evidence: CN preflight found the key absent from the canonical configuration source while the current hotfixed `api.env` contained it.

Start at the canonical cloud provision renderer and the deployment configuration validation path, then trace how api.env is generated. Add coverage for projecting PLATFORM_SUPERUSER_EMAILS, optional omission, bounded case-insensitive duplicate rejection, and secret-safe output; run the relevant provision and configuration tests to confirm the expected environment and validation behavior.

Written by the indexing model from the issue text.