fix(preflight): make production preflight non-destructive before quality gates #684

Parent epic: #679

Evidence

scripts/production-preflight.ts currently runs configuration, then db:migrate, then specification/tests/build. A failed later gate can therefore leave the target database mutated. Database pool-health skip behavior can also still permit a go-live result.

Objective

Make the default preflight read-only and require explicit, auditable authorization for migration application.

Scope

• Reorder checks: config/security, connectivity/read-only schema inspection, specs/contracts, tests/build, migration plan, then optional apply.
• Make --apply-migrations explicit; default invocation must not mutate data/schema.
• Require backup evidence and a target-environment acknowledgement before apply.
• Block production go-live when mandatory DB/pool checks are skipped.
• Add dry-run migration plan output and structured machine-readable result.
• Document rehearsal and rollback procedure.

Acceptance criteria

• Default bun run production:preflight is non-mutating.
• Failed quality gates never apply migrations.
• Production apply requires explicit flag and acknowledgement.
• Mandatory skips yield non-zero/blocking result in production profile.
• Tests prove ordering and mutation guards.
• Runbook includes staging rehearsal, backup verification, rollback, and evidence retention.