feat: add writer-first sgf.dev rollouts

[glitchedmob]

Splits sgf.dev into ordered writer and subscriber Deployments so the writer completes migrations before the subscriber updates and the frontend remains available. Do not merge until the server-role application image is published and both overlays are pinned to it.

• Deploy the scheduling publisher in Argo wave 1 and wait for readiness before updating the wave-2 subscriber.
• Preserve the existing Deployment as the subscriber for a safe initial service handoff.
• Co-locate both Pods with the Longhorn RWO volume and share SQLite, Data Protection keys, and ImageSharp cache data.
• Keep TEMP state private and persist separate Examine indexes for each role.
• Route /umbraco and /api traffic exclusively to the writer.
• Disable unattended core and package migrations on the subscriber.