A roll that cannot surge waits for the owner's yes to that roll #1589

Split from #1072. When the check from the issue before this one says no surge, the release agent does not roll: it reports the seconds the roll would be dark and the headroom that would avoid it, and waits for the owner's explicit yes to that one roll (named by version), never a standing yes.

Done:

• [ ] The release checklist (docs/ops) and the roll recipe refuse a dark roll without that yes, and record the yes beside the version.
• [ ] A test asserts the gitops overlay never carries maxSurge: 0 as a standing value.
• [ ] A test: no headroom and no yes means no roll; a yes for another version does not count.

A test that goes red in this pull is fixed in this pull. Name any new test file in GATE in scripts/gate.ts.

Parked by the crew: the check stayed red through 2 automatic tries (pull #1653 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.