Complete promotable GitOps lifecycle (#156)

[AntoineToussaint]

Closes #156.

Summary

• separate immutable service snapshots from module bootstrap generation so generators consume reviewed Git state
• keep production rendering secret-free and offline while binding optional live admission to the exact declared cluster context
• publish environment-owned module paths consistently through render, review, observation, and rollback

Test plan

• go test ./...
• focused orchestration, GitOps, and deploy command tests