Make the live deployment gate race-safe

[shfqrkhn]

What changed

• replace the stale hardcoded live cache-version assertion with a generic PWA cache check
• make main push checks wait for the live service-worker cache to match the checked-out source
• keep pull requests running branch-local gates plus a smoke check of the currently deployed site
• document the deployment-gate behavior in the maintainer handoff

Root cause

Pages deployment and Static Check run concurrently after a merge. The previous live test expected the old v40 cache while the newly deployed app correctly served v45, causing a false post-merge failure.

Validation

• npm run qa
• MODELTAB_REQUIRE_CURRENT_DEPLOYMENT=true npm run test:live
• 23 visual, 29 provider, 3 live, module, worker, link, static, and local-file checks passed
• secret-indicator and git diff --check gates passed