Gate deploys on the test suite: two-stage on dev, read-only tests on prod

[saqibmanan]

What: Deploys are now gated by the test suite: on dev, smoke runs first and functional only if smoke passes; a failure in either rolls back. Prod runs the read-only allowlist after deploy, then finalize.

Evidence: dev run 34969551584 — smoke 3/3, functional 2/2, finalize success. Prod run 35009343088 — read-only api + consumer passed, provider skipped, finalize success.

Fix: PRs #178/#179/#180/#183 (deploy-backend.yml, pr-gate.yml).