Preflight the deployment control plane before publishing an image

Before publishing an expensive immutable candidate, validate the target supervisor contract, operator privilege boundary, registry-read path, canonical environment and secret ownership, checkpoint ownership, and rollback artifact. A green image pipeline proves artifact quality, not host readiness. If the live service has drifted from the checked-in supervisor model, treat deployment as a controlled migration with prepared rollback, not an in-place image swap.