feat(status): publish safe deployment and agent evidence

[zoeyrose]

Summary

Define an operator-safe status and observability contract for control-plane
targets, jobs, deployments, and hardware validation.

Implementation / behavior

• Publish bounded target online/offline state, current and desired digest,
  deployment outcome, last successful transition, and failure reason.
• Retain correlation IDs linking GitHub workflow runs, image digests, target
  jobs, and agent acknowledgements without retaining secrets or raw network
  addresses.
• Provide a read-only status API suitable for atrinik/observatory.
• Add notification hooks for failed automatic deployments and expired
  approvals without exposing control operations.

Acceptance criteria

• Status readback is authenticated where it contains operational detail and
  redacts credentials, player data, and unnecessary host identity.
• Rapid merges and offline agents converge to one clearly identified desired
  state.
• Observatory can consume a versioned, provider-neutral status contract.
• Retention and privacy behavior is documented and tested.

Dependencies

• Control plane:
  feat(control): implement NAT-friendly agent control plane #2
• Future consumer:
  feat(deploy): surface agent and deployment evidence observatory#28

Non-goals

• Do not expose an administrative deployment endpoint through the public status
  surface.