Close the gaps in DORA's deployment automation checklist

[atkrad]

docs/comparison.md points at DORA's deployment automation checklist. This issue tracks the gaps until we can walk that list honestly.

https://dora.dev/capabilities/deployment-automation/

The list, roughly: same package in every environment, config separate from the app, no manual deploy steps, deploy-time tasks (migrations), a real check after deploy, and a record of what is running where.

Already there

• Same image and spec everywhere. Only resolution changes per environment.
• deployah deploy -y is enough for CI (--output json, --detailed-exitcode).
• Deploy waits until resources settle and rolls back on failure (default --timeout 10m).
• Cluster, domains, TLS, and profiles live in deployah.platform.yaml.
• Deploy-time tasks: tasks: run-to-completion work (replaces role: job) #17 (tasks:, not role: job).

Still open

• Component env still does not reach the container. Task env does. Related later: proposal: support SOPS-encrypted env files #78 (SOPS).
• No real deployment test. Default probes say the process is up, not that the app can talk to the database. A postDeploy smoke task can cover this, or we document that probes are as far as we go.
• list / status show Helm revision, not which image is running. Pairs with proposal: support deployah rollback #29.
• Alpha schema: only v1-alpha.5 is accepted. Fine for now; freeze the story when we leave alpha.

Image builds stay in CI. Blue/green (#33) and canary (#34) are separate.