feat(cloud-deploy): add fail-closed fast-safe CN release lane

CN production releases currently mix artifact preparation, traffic activation, and failure interpretation. That makes a five-minute provision target hard to prove and allows a late CI or configuration surprise to block or endanger activation.

Implement a fail-closed fast-safe release lane with two explicit phases:

- `prepare` freezes an exact `main` SHA, classifies source/migration risk, builds and verifies four immutable application digests, renders canonical configuration, and runs shadow/readiness/business checks without changing traffic.
- `activate` requires the prepared receipt, drains active runs, compare-and-swaps the recorded production baseline, advances `main-cn` as the prepared-release pointer, atomically switches the stack, proves canonical 8/8 plus browser smoke, and automatically restores the recorded baseline on failure.
- CI failures are machine-classified. Product or unknown failures always block. Only stale-test or infrastructure failures with an issue, immutable evidence, owner, and expiry may be explicitly waived; skips are never silent.
- Canonical configuration persists ASR, platform superuser, and GitHub Issue profiles, and the ingress contract requires both CopilotKit locations to retain 3600-second read/send timeouts.
- Once all preparation gates pass, activation/provision completes within five minutes.

Scope is limited to production release scripts, `packages/cloud-deploy`, deployment documentation, tests, and an ADR. It does not change chat product behavior.

Start with the production release scripts and the packages/cloud-deploy scope, then read the deployment documentation, existing tests, and ADR context. Trace how preparation, activation, failure classification, configuration, and ingress checks are currently represented. Done means the two-phase lane enforces the stated gates, blocks unapproved failures, restores the baseline on activation failure, and meets the five-minute provision target.

Written by the indexing model from the issue text.