fix: allow authenticated local Railway deploys

[CountableNewt]

What changed

• keep GitHub Actions fail-closed when the environment-scoped Railway token is absent
• allow a clean local exact-SHA deployment when the Railway CLI session is authenticated
• add a regression fixture covering local success, CI token rejection, and unauthenticated local rejection
• replace stale Development rollback instructions with Railway deployment snapshots and an additive-schema recovery boundary
• align operator docs with automatic Development, protected manual Production, full SHA arguments, and environment-scoped GitHub secrets

Why

The first Development workflow passed CI but correctly stopped before upload because RAILWAY_DEVELOPMENT_TOKEN is not configured. The release script also rejected the authenticated local CLI fallback unconditionally. This narrows the token requirement to CI while retaining every branch, SHA, clean-tree, remote-tip, project, environment, and service guard. The self-review also found stale and incomplete release instructions that named already-decommissioned providers or omitted the required SHA.

Testing

• bash scripts/test-railway-deploy.sh
• git diff --check
• full required CI pending on final head 7b75e8b

Release

After required CI and merge to dev, deploy the exact merge SHA Gateway first, then Web. Application rollback restores prior Railway service deployments while leaving additive schema in place. Production remains gated by MCP-4 and explicit approval.

Linear: MCP-5

[linear-code]

MCP-2