[Phase 2] Replace PUT-contents clobber deploy with versioned, ring-staged, health-gated promotion

[don-petry]

Parent: #495 · Phase 2 · Work type: Infra · Targets SC3, SC5, SC8.

Replace deploy-pr-review.yml/force-deploy-pr-review.yml (PUT /contents clobber of all consumers' main at once) with a versioned, ring-staged promotion workflow whose only action is moving channel tags (git tag -f <ring> <vX.Y.Z> && git push -f). Ring N+1's tag advances only when an automated health gate confirms ring N is healthy (run-success rate, cancellation rate, no new failure-report issues over a soak window). The promotion workflow is the sole authorized mover of channel tags (paired with the tag-protection rules).

Done when: no path overwrites consumer files or >1 ring at a time; promotion is a health-gated tag move.

Ref: §2.3, §5.1, §7 Phase 2.

[github-actions]

Thanks for opening this and linking it back to the parent initiative — the done-when criteria and the reference to §2.3 give a clear target to build toward. For the health gate, could you share the intended ring topology (e.g., how many rings, which consumers map to each) and the concrete thresholds you have in mind for run-success rate and soak window duration? That'll help scope the gate logic and avoid revisiting those parameters mid-implementation.