V2 deployment qualification: signed images, staging rollout and live rollback

The v2 revival supplies deterministic local artifact generation, policy validation, previews, artifact rollback, official SDK MCP/CLI, MetaHarness profiles and Autogenous evidence gates. Historical model-selected shell execution is retired.

Production qualification remains explicit:

• Supply real reviewed image/base digests and compatible app/server executable.
• Verify image signatures and vulnerabilities with deployment-owned trust roots.
• Exercise Kubernetes server-side dry run and actual rollout under a namespace-scoped short-lived identity.
• Validate NetworkPolicy with the deployed CNI and readiness/liveness behavior.
• Test live revision compare-and-swap plus rollback and any database restoration separately.
• Configure durable MetaHarness field-memory storage and identity verifier; do not treat scaffold as deployed service.

Acceptance: staging workload passes admission, rejects unauthorized effects, survives a failed rollout, restores the prior revision and emits independent provenance evidence. No cloud credentials were accessed or production changes executed by the revival.

The issue names no files, tests, or code entry points. Start by mapping the deployment qualification flow and its Kubernetes admission, rollout, rollback, identity, NetworkPolicy, and MetaHarness components. Done means a staging workload passes admission, rejects unauthorized effects, survives a failed rollout, restores the prior revision, and emits independent provenance evidence.