Deploy circuit breaker + fail-first

Deploy circuit breaker + fail-first

Two consecutive deploy failures to the same env for the same change means
stop retrying and stop hand-patching hosts — write
.agents/plans/YYYY-MM-DD-deploy-simplify-<topic>.md and remove or fix the
faulty layer before a third attempt. Hand patches must land as repo
changes in the same session or be reverted. Deploy problems must surface
pre-merge (--dry, PR check, mise run deploy:rehearse), never first
after merge. Pull dispatch is forbidden for every runtime — push-only
(submit(job) -> call_id + status(call_id), packages/jobs/AGENTS.md).
Rationale: .agents/notes/2026-10-07-deploy-feedback-loop.md.