Add deterministic GitOps promotion (#152) - #155

Closes #152.

Summary

• Prevent stale or unsafe manifests from entering promotion by installing validated, inventoried owned trees atomically.
• Keep remote deployment review-driven and prove every transition with exact render, Git, pull request, Argo CD, and cluster identities.
• Make recovery auditable by re-promoting only revisions with prior reviewed Healthy evidence.

Test plan

• go test -failfast ./...
• go test -failfast -race ./...
• go vet ./...
• go run . deploy gitops --help
• CODEFLY_GITOPS_K3D_QUALIFY=1 go test ./pkg/gitops -run TestLocalK3dDisposableGitQualification -v -count=1 -timeout=12m

Risk

• The opt-in qualification test creates a uniquely named disposable k3d cluster and helper Git container, then deletes only those exact resources. The successful local run completed cleanup and left the existing codefly-local cluster untouched.