Self-deploy rollback, part 1: `bun src/main.ts --rollback <sha>` swaps back to a kept release, and refuses one whose schema is behind the live database

Split from #1664. For: a bad release can be undone from the shell in one command.

Done looks like:

[ ] --rollback <sha> finds releases/<sha>/ (releaseDir in src/release/checkout.ts) and swaps to it through startRelease in src/release/swap.ts, the same health-read swap as a landing; the old process keeps serving if the health read fails.
[ ] An unknown sha, or one pruned away, is refused with one line naming it.
[ ] A kept release whose schema version is older than the live database's is refused with one line ("<sha> predates schema N; rolling back would need a down-migration"). The database's existing refusal of a future schema stays exactly as it is: the earlier try went red on db > future schema refuses to run by loosening it. Do not loosen it.
[ ] Tests in test/release-rollback.test.ts, named in GATE in scripts/gate.ts in the same commit: known sha swaps and health names the old sha; unknown sha refused; older-schema sha refused. Run them with test/db.test.ts, test/release-swap.test.ts, test/release-checkout.test.ts and bun x tsc --noEmit before pushing.

Files: src/main.ts, src/release/rollback.ts (new), the test, scripts/gate.ts.

Self-deploy rollback, part 1: `bun src/main.ts --rollback <sha>` swaps back to a kept release, and refuses one whose schema is behind the live database #1823