test: cover core rollback under the two-environment model

[joshua-temple]

Problem: the suite walked seed -> staging -> prod publish but never exercised a manual rollback under the two-environment model, leaving the core rollback path unproven on real GitHub for this repo.

Change: a new rollback-check job (between promote-staging and dispatch-inputs-check) lands a second staging version so the deploy-history ring carries a prior entry, dispatches the already-generated cascade-rollback.yaml for staging, waits via the established gh run list --created + gh run watch --exit-status --interval 60 idiom, then asserts via yq on .github/manifest.yaml that .ci.state.staging.version moved back to the prior entry and .ci.state.staging.ref == rollback/staging.

Note on target: staging is the deployable env in this [staging, prod] model. prod is the publish boundary and emits no deploy jobs, so its env state stays empty and it carries no deploy-history ring; a rollback of prod has no prior target to resolve. staging is therefore the env that exercises the core rollback path, matching the behavior the local harness proves.

How it proves the gap: it dispatches the generated rollback workflow and reads back the rolled-back version and the divergence ref from trunk, proving the rollback re-deploy and finalize state write on real GitHub.

Verification: actionlint clean; yq parse clean; guardrail scans clean.

[github-actions]

Cascade plan preview

This merge would:

• No build or deploy would be triggered by this merge.