For Railway private-registry credential changes, determine the actual environment write
General lesson: For Railway private-registry credential changes, determine the actual environment write scope before mutating an existing service. On a non-fork environment, `serviceInstanceUpdate` documents fanout to other non-fork environments; an environment-config patch may s…