Self-deploy rollback, part 2: a releases page lists each kept release with sha, landed pull, when and healthy-since, and a writer can roll back from it #1824

Split from #1664. For: the owner sees what is live and can undo it from the browser.

Done looks like:

• [ ] src/web/pages/releases.ts lists listReleases (from src/release/record.ts): short sha, the pull that landed it (linked), when, healthy since; the live one marked; server-rendered, every field escaped.
• [ ] A writer sees a Roll back button on each kept, schema-compatible release; it POSTs through part 1's rollback, same-origin checked; anyone else sees no button and a POST from them is a 403.
• [ ] The home shows one line "live: <sha> since <time>" linking to the page.
• [ ] No existing API response changes shape: the earlier try went red on a site admin with a read-only token gets the shape; others get the short one. Run that test file with your own.
• [ ] Tests in a new file named in GATE: the page lists releases, a non-writer gets no button and a 403, a cross-origin POST is refused.

Files: src/web/pages/releases.ts (new), its route in src/http/server.ts, the home, the test, scripts/gate.ts.