refactor(lastcode): separate deployment infrastructure

[lastobelus]

A clean checkout used as a project metadata anchor can drift after rebased branch promotion, while the public repository had also accumulated deployment-specific orchestration that did not belong in a reusable LastCode toolset.

This change adds an explicit, environment-neutral managed-checkout command. It validates the checkout path, repository identity, selected branch, clean state, active Git operations, initialized submodules, and ignored-content collisions; fetches only the configured remote branch; retains the old tip; and updates the branch with compare-and-swap semantics. The caller supplies all paths, refs, and scheduling policy through infrastructure-owned configuration.

It also removes the deployment-specific daily updater from this repository, keeps the generic staging, installation, and headless-service primitives, replaces deployment-identifying examples and fixtures with generic values, and records the public/private repository boundary in contributor guidance.

Validation:

• Run Quick CI Project Action
• focused managed-checkout, staging, headless-service, workflow, and environment-label tests
• public-tree infrastructure-identifier scan

Implemented by GPT-5.6 Codex in T3 Code.