fix: harden stable promotion and MCP gateway failures

[Proxicon]

Closes #67

Summary

• harden the manual stable-promotion workflow around immutable release inputs and safe partial-failure recovery;
• return deliberate, safe HTTP gateway delegation failures instead of treating dependency failures as invalid credentials;
• make the public MCP deployment package explicitly versioned and validate its real extracted Compose recipes; and
• extend persisted gateway-access coverage for simultaneous differently-scoped credentials.

Requirement-to-evidence matrix

Requirement	Evidence
Stable promotion	test-validate-stable-promotion.py exercises no-checkout fixture operation, source/release/asset/checksum rejection, pagination/monotonicity, image allowlisting and missing platform rejection before a plan is produced. The workflow resolves a peeled tag, verifies main ancestry, validates all immutable digests before any mutable write, then reads each latest reference back.
Gateway failures	McpHttpHostTests covers upstream 401/403/429/500/503, bounded retry-after, malformed and oversized replies, header/body deadline stalls, reset/refused connections, caller cancellation and no fallback.
Deployment archive	The release rehearsal checks checksums and extracted binaries. test-deployment-archive-compose-config.sh renders the actual packaged standalone gateway, combined gateway and explicit-Authentik Compose recipes.
Joined access coverage	McpGatewayRealAccessPipelineTests retains real SQLite/PostgreSQL persistence and adds simultaneous credential scope isolation plus wrong-purpose rejection; host tests exercise real delegation/current-identity and credential revocation. Existing direct API/stdio parity coverage remains.

Validation run locally

• dotnet test Helpdesk.sln --configuration Release --no-restore --verbosity minimal — 1,198 passed, 6 existing skips.
• Focused MCP/gateway suite — 29 passed.
• Stable-promotion helper tests — 5 passed.
• Layout, public-disclosure, YAML and changed-file generated-code checks passed.
• Production API, web and HTTP MCP Dockerfiles built; gateway Compose smoke and web static-assets smoke passed.
• Release archive packaging, checksums, extracted Linux x64 executables and actual extracted Compose rendering passed.

Deliberate non-actions / follow-up evidence

No release, deployment, tag, image publication, or stable-channel promotion was performed. External configured-Authentik validation remains a separately recorded manual acceptance exercise; this PR does not use operator credentials or claim that evidence.