Fix generic-web prod promotion source integrity

[cbusillo]

Objective

Fix generic-web production promotion so it can only promote the latest verified testing artifact and can publish the matching GitHub release reliably.

Finish Line

Generic-web prod promotion deploys and releases the current verified testing artifact

Current Status

State: Done. PR #419 merged/deployed and SYO PR #95 merged; SYO prod promotion run 25520881173 succeeded with Launchplane-owned release creation.
Next action: None for source integrity or release creation. Continue separately with worker/session cleanup #417 and future merge-train work #410/#412 when ready.
Blocked by: None.
Last verified: 2026-05-07. Testing and prod health both report revision 215f71bc1a58639fe4bcd3b3609a4e68304184ab; GitHub release v0.2.10 points at the same commit.

Scope

• Launchplane generic-web deploy inventory writes.
• Generic-web prod promotion source/ref replay safety.
• SYO promote-prod workflow release creation identity/permissions.
• Recovery procedure for the currently unpromoted 41620cf SYO main artifact.

Acceptance Criteria

• A successful /v1/drivers/generic-web/deploy writes/updates EnvironmentInventory for the deployed context + instance with artifact id and source git ref.
• A failed generic-web deploy does not update environment inventory.
• Prod promotion does not replay or accept stale source inventory when the current testing inventory points at a newer artifact/ref.
• SYO promote-prod can create the GitHub release using an explicit release-capable identity, or the workflow clearly separates Launchplane promotion from manual release creation.
• A live recovery promotes SYO 41620cf13151d1a12f09d06007d67bdf791d200c to prod and verifies prod health reports that revision.
• Release/tag state for the recovered promotion is correct and points at the promoted revision.

Relationships

Related to SYO production promotion failure in run 25518394996 and Launchplane generic-web deployment/promotion flows.

Validation

• Unit tests for generic-web successful deploy inventory update and failed deploy no-op inventory behavior.
• Unit tests for prod promotion stale replay/source-ref guardrail.
• SYO workflow dry run or live run with explicit artifact/ref after fix deploys.
• Direct prod health check verifies promoted revision.

Decisions

• Pause further SYO prod promotion automation until this is fixed correctly.
• Treat stale inventory promotion as a correctness bug, not an operator retry problem.
• Use explicit artifact/ref for recovery only after Launchplane inventory semantics are fixed or bypassed intentionally.

Open Questions

• Should release creation move into Launchplane using a GitHub App/PAT release identity, or should SYO Actions receive a dedicated release token secret?
• Should prod promotion become non-idempotent by default, or keep idempotency but reject stale current-inventory mismatches?