fix(ST-28): serialize deployment and lockdown

[afaryy]

Root cause

A post-merge deployment and the manually dispatched lockdown ran under different concurrency groups. Deploy used the Terraform default public_ingress=true, reopening services that lockdown had just restricted.

Changes

• serialize application deployment and public-domain control with the same non-cancelling concurrency group
• preserve the existing API/Web ingress mode during deployment
• treat only explicit Cloud Run NOT_FOUND as an absent service; other probe errors fail closed
• add regression coverage for the shared lock and ingress propagation

Verification

• npm test in infra/terraform/tools/config-validator — 9 passing
• git diff --check
• independent review completed; P1 fail-open finding fixed and re-reviewed

Follow-up

After this PR merges and its automatic deployment completes, run the guarded lockdown workflow once more. It will lock both services; future deployments will preserve that state.