ci(deploy): /health fallback + forensics capture for transient Fly API timeouts (closes #4780)

[bokelley]

Summary

Closes #4780. Surfaced by today's outage post-mortem (PRs #4769 hotfix, #4773 structural fix).

v2760 (the hotfix release) was marked `failed` in Fly's release ledger because `flyctl deploy` timed out at 5 minutes polling the third web machine's health (`net/http: request canceled` against `api.machines.dev`). The Fly machines API was rate-limited from the earlier crashloop storm. The app itself was healthy — `adcontextprotocol.org` served 200 throughout — but the deploy job exited 1 and the post-deploy verification gates (machine-image-consistency, training-agent tenant smoke, stale-console cleanup) never ran.

Changes

1. `Deploy` step captures `flyctl deploy` exit code instead of letting it short-circuit the job. On non-zero, probes `https://adcontextprotocol.org/health\` and stores outcome in step output `deploy_outcome`:
   • `success` — flyctl exited 0
   • `fallback-success` — flyctl failed but `/health=200`. Warning, continue.
   • `hard-fail` — flyctl failed and `/health!=200`. Exit 1.
2. `Verify all app machines are on same image` now skips on `fallback-success` — that gate also goes through the Fly machines API (the thing that timed out in the first place).
3. `Smoke training-agent tenants` unchanged. Uses external HTTP, independent of Fly API.
4. Forensics capture on any failure: `flyctl status`, `machines list --json`, `releases`, last 500 lines of `flyctl logs`, plus a summary file with `deploy_outcome`, SHA, run ID. Uploaded as artifact `fly-forensics-{run_id}` with 30-day retention. Today's incident cost a debug cycle because Fly log retention is short.

Test plan

• CI green
• On merge: next `flyctl deploy` happy path completes as `success` (deploy_outcome=success), all gates run, no artifact uploaded (failure() didn't trigger)
• Eventually: when next transient Fly API issue happens, the workflow logs `fallback-success` and the tenant smoke still runs

Risk

Bounded to the deploy workflow. Doesn't affect prod runtime. The conservative direction: if /health is genuinely down AND flyctl timed out, we still hard-fail.

🤖 Generated with Claude Code