fix(deploy_failure_autopsy): capture build logs + emit failure email backstop

[mastermanas805]

Summary

PR 2 of the 2026-05-30 silent-deploy-failure fix (paired with
#65 / fix/deploy-status-reconcile-job-failed). Closes the autopsy side of
the bug class: the user's deploy got a (now-correctly-detected) status flip
to `failed` via PR 1, but their UI still showed an empty error column and
no email arrived because the autopsy never:

• updated `deployments.error_message` with a human-readable cause,
• emitted an `audit_log` row of kind=`deploy.failed` (the api's
  runDeploy normally emits this, but the api goroutine had crashed
  mid-build so it never fired),
• fell back to the build pod's logs when the runtime app pod was
  never created (the modal case for Job-failed deploys).

This PR adds:

1. Build-pod log fallback. When the app-pod query yields no logs,
   list pods matching label `job-name=build-` and pull the
   kaniko stderr tail. Reason is upgraded from Unknown → BuildFailed.

2. error_message stamping. `: ` (first
   sentence of the hint, capped at 200 chars) is written to
   `deployments.error_message` IFF the column is NULL or empty
   (non-clobber guard preserves an api-side specific error).

3. Audit-log emit. Looks up `team_id` from deployments, then
   INSERTs an `audit_log` row with kind=`deploy.failed` and
   metadata `source: "worker_autopsy"` so an operator can
   distinguish the worker backstop from the api's emit.

Rule 25 observability

New Prom counter `instant_deploy_autopsy_captured_total{outcome}`
with bounded labels: `logs_captured`, `logs_unavailable`,
`already_present`, `audit_emit_failed`. NR alert suggestions
inline. All four label families primed at process start so the
dashboard panel renders from scrape #1.

Coverage block (rule 17)

```
Symptom: failed deployments had no error_message in the API row
and the user never received the deploy.failed email.
Enumeration: rg "captureDeploymentAutopsy|deploy.failed|error_message"
Sites found: 1 (deploy_failure_autopsy.go:captureDeploymentAutopsy)
Sites touched: 1 (callers in deploy_status_reconcile.go unchanged)
Coverage test: TestAutopsy_PodAlive_CapturesLogs
TestAutopsy_PodGCd_FallsBackToJobEvent
TestAutopsy_Idempotent
TestAutopsy_BuildPodFallback
TestUpdateDeploymentErrorMessage_OnlyUpdatesEmptyColumn
TestUpdateDeploymentErrorMessage_DBError
TestFirstSentence
TestEmitDeployFailedAudit_{NoRow,LookupError,NilTeamID,InsertError,SummaryTruncation}
TestAutopsyAlreadyPresentWithReason (3 branches)
TestFindBuildPodName (3 branches)
TestAutopsy_NamespaceMismatch_EarlyReturn
Live verified: PENDING — verify post-merge via rule 14, trigger a
deliberately failing Dockerfile build, confirm user
receives the deploy.failed email AND GET /deploy/:id
returns a populated error_message + failure.last_lines.
```

Test plan

• `make gate` green locally
• All new tests pass
• CI green
• After merge + deploy: rule 14 `/healthz` SHA gate
• After merge + deploy: enqueue a deliberately failing build,
  observe (a) email in inbox, (b) error_message populated in API,
  (c) failure.last_lines contains kaniko stderr.

🤖 Generated with Claude Code