Reuse proxy transport settings, not environment identity

When promoting a private proxy, reuse the immutable image and non-secret listener, timeout, restart, replica, and no-public-domain settings. Treat service identity, persistent state, hostname, enrollment identity, access policy, and upstream bearer as environment-owned. Set traffic mode explicitly local before wiring credentials, then verify deployed-path readiness and acceptance separately from platform health.