fix: separate public monitoring from deployment gate

[Zk-nd3r]

Summary

• split scheduled public monitoring from the secret-bearing exact deployment gate
• keep anchor structure fail-closed while stale freshness is an explicit warning during the operator pause
• add a separate scheduled public API privacy-contract check
• make exact source/image/admin/current-proof verification manual-only
• pin action revisions and set the workflow token to read-only
• enforce the separation in the operational-control validator and document the claim boundary

Validation

• workflow YAML parsed with exactly three gated jobs
• Python compilation passed
• operational-control contracts passed
• 9 anchor-liveness policy tests passed
• evaluator privacy/health/proof self-tests passed
• git diff --check passed

Operational boundary

A green public monitor is not a deployment attestation. The live legacy service is expected to keep the public API contract job red until the separately gated f107-derived deployment is complete. This change does not set repository secrets or variables, dispatch the strict deployment gate, or authorize an anchor transaction.