fix(content): move Option-B fast-path flags from env vars to DB config (ImsConfig)

[jung-thomas]

Why

The three Option-B content fast-path flags — CONTENT_DELTA_WRITE_ENABLED, CONTENT_DELTA_READ_ENABLED, CONTENT_DELTA_SKIP_CARRYFORWARD — were read directly from process.env (16 sites) and declared kind:'env' in the feature-flag registry. Env flags are set via cf set-env and silently dropped on every blue-green MTA deploy (new -idle apps start from the descriptor, not the old app's runtime env), which reverted the PROD fast path during the 1.20.0 deploy and forced a manual multi-step re-activation. Feature flags must be DB-configurable (standing rule; matches ngds-autosend).

What

Move the three flags to the ImsConfig key/value table, read through a cached, fail-safe resolver. All process.env.CONTENT_DELTA_* reads removed — no env fallback. They're now data, so they survive every deploy.

• New srv/lib/content-delta-flags.js — mirrors the ngds-autosend.js cached-DB-flag pattern. One warm cache (all 3 keys in a single SELECT), 60s TTL. Synchronous getters isDeltaWrite()/isDeltaRead()/isDeltaSkipCarryForward() return the last-known boolean immediately and kick off a non-blocking background refresh when stale — never block, never throw. Fail-safe default false (legacy path) so a cold cache or DB error never silently enables delta reads/writes. refreshContentDeltaFlags() (fail-safe) + bustContentDeltaFlagsCache(). Keys: content.delta.write, content.delta.read, content.delta.skipCarryForward.
• srv/server.js — warms the cache in the served bootstrap (fail-open).
• 16 call sites across content-store.js, content-publish-session.js, chrome-shell.js, admin-service.js, jobs/{cleanup,embedding-reconciliation}.js, embedding-pipeline.js, embedding-stats.js — exact boolean semantics preserved (incl. the !== 'true' → !isDeltaSkipCarryForward() inversion in the publish carry-forward gate).
• registry.js — the 3 entries flipped kind:'env' → new kind:'db' (ImsConfig-backed; resolve.js resolves it live); env fields dropped.
• Admin toggle — AdminService.setContentDeltaFlags(write, read, skipCarryForward) (per-flag upsert, busts cache) + getContentDeltaFlags(), @requires: 'Admin' (same as the NGDS kill-switch).
• srv-qa cp-list — content-delta-flags.js added to .deploy/mta.yaml tutorials-srv-qa (transitive dep of content-store.js et al.).
• Tests — new test/unit/content-delta-flags.test.js (defaults, read, TTL cache, bust, DB-error fail-safe); the 3 existing env-driven delta tests converted to seed ImsConfig. Verified: cds compile clean, grep process.env.CONTENT_DELTA_ srv/ empty, 18 delta tests + adjacent suites green.

Rollout after merge/deploy

1. Deploy this to each env.
2. Set the DB values once (admin action or ImsConfig upsert) — they persist across deploys.
3. Remove the temporary cf set-env CONTENT_DELTA_* vars currently on PROD tutorials-srv/tutorials-srv-qa (the stopgap that restored the fast path tonight) so DB is the single source of truth.

Notes

• Follow-up issue Migrate remaining kind:'env' feature flags to DB config (ImsConfig) #2060 tracks migrating the remaining ~14 kind:'env' registry flags the same way.
• Minor: the admin action busts the cache but doesn't warm-refresh, so a just-toggled flag reads its fail-safe default for up to ~1s until the background refresh lands (safe: falls back to legacy, never errors). Can add an await refreshContentDeltaFlags() if we want instant toggle effect.