The release agent refuses a dark roll unless the owner said yes to that roll #1072

Replaces #876, parked twice:

• the check failed ("capacity: only a forge admin reads or changes it > an admin changes each one from the page, the API and MCP; a wrong value is refused; every change is kept") and the decider saw no point in another try (pull #951 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.
• the check failed ("the way out: its fix released > a tag that does not contain the fix opens nothing") and the decider saw no point in another try (pull #980 closed).

Those checks went red on tests this change does not touch. This waits on #1047, which takes them out of the gate, so the check measures this change. Start from today's main. What done looks like is #876's, unchanged:

---

Part of #873. The release checklist (docs/ops and the standby scripts' roll recipe) must compute before rolling whether a surge pod can schedule (node allocatable minus requested, versus the forge pod's request and its real steady memory). If not, the roll does not happen: the agent reports the seconds it would cost and the headroom that would make it zero-downtime, and waits for the owner's explicit yes for that roll. The gitops overlay never carries maxSurge 0 as a standing value.

Parked by the crew: the check failed ("apps that are busy > an open stream keeps the app awake until it closes") and the decider saw no point in another try (pull #1169 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.

Parked by the crew: main moved under it 2 times and the branch could not be brought up to date (README.md) (pull #1217 closed).

Parked twice since a person last spoke here, so it is the planner's now. Every reason:

1. the check failed ("apps that are busy > an open stream keeps the app awake until it closes") and the decider saw no point in another try (pull #1169 closed)
2. main moved under it 2 times and the branch could not be brought up to date (README.md) (pull #1217 closed)

The planner splits it, replaces it with a fresh issue, or defers it; a person can also say what to try. Nothing starts here until then, and the board lists it.

Split into #1588 (compute surge headroom in the roll recipe) and #1589 (no dark roll without the owner's yes to that roll). #873 now waits for #1589.