fix(ci): restore main when production stays DIVERGED with nothing queued #4186

🤖 Generated by the Agentic Engineer

Evidence: review of platform#4177 (four rounds) showed that any eviction decision taken inside the merge-group run and acted on by a separately scheduled job leaves residual cases: a heal decided outside the prod-deploy lock can be overtaken; a queue that stays busy past the polling bound, or a normal cancellation after a successful deploy, writes no answer; and a PR amended to drop its manifest changes and re-enqueued can merge without redeploying. In each, production keeps a speculative artifact that main does not contain. validate-main.yaml already reports DIVERGED, but deliberately does not redeploy because a deployed-but-unmerged group also reads DIVERGED, and it only runs on a push to main — an eviction pushes nothing.

Problem: production can stay on an artifact that never reached main until an unrelated deploy happens.

Hypothesis: judging the END STATE under the lock closes every residual case at once: DIVERGED with an empty merge queue and no merge-group run in flight can only be a stranded artifact.

Smallest useful change: a scheduled (and dispatchable) job that holds the prod-deploy lock, runs the existing convergence report, and — only when the verdict is DIVERGED, the merge queue is empty and no merge-group run is in progress — dispatches the existing redeploy of main. A failed read decides nothing.

Acceptance criteria

• Runs on a schedule and on demand, inside the shared prod-deploy lock.
• Redeploys main only on DIVERGED + empty queue + no in-flight merge-group run; any failed read redeploys nothing.
• Tests cover each gate (a queued group, an in-flight run, CONVERGED/BEHIND, a failed read) with no redeploy, and the stranded case with one.

Size: medium.