Restore guarded MCP production deployment

[BYK]

Summary

• Restore production deployment only for successful push-triggered Test runs on the current main revision; verify main before canary and production, and keep the job in the protected production environment.
• Capture the active Worker deployment before changing traffic, identify the run-owned candidate by exact deployment message and IDs, and recover only by explicitly deploying the captured version while ownership remains intact. Remove bare rollback and direct production deployment scripts.
• Add lifecycle, race, workflow, and pin regressions; document the protected flow.

Validation

• Node 22: pnpm run tsc, pnpm run lint, pnpm run test:ci-projects, pnpm run docs:check passed.
• Full pnpm run test: 10,180 CLI tests passed; one unrelated 1 MB ZIP test hit its 15-second timeout during the suite. Isolated rerun of that file passed all 15 tests.

The Cloudflare API deployment shape and installed Wrangler command flags were checked. Production rollout awaits exact-head CI and Warden review, plus moving CLOUDFLARE_API_TOKEN into the main-restricted production environment.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want reviews to match your repository better? Bugbot Learning can learn team-specific rules from PR activity. A team admin can enable Learning in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit da92d14. Configure here.}