fix(deploy): guarded CAS on redeploy 'building' flip — close TOCTOU (#14)

[mastermanas805]

What

Closes sweep finding #14 (P3, TOCTOU): redeploy unconditionally flips an expired/deleted deploy back to building.

Both redeploy entry points — POST /deploy/:id/redeploy and POST /deploy/new (redeploy=true) — read the deployment row, assert it's non-terminal (IsDeploymentTerminal / FindActiveDeploymentByTeamEnvName), then flip it to building. Between the read and the flip, the DeploymentExpirer / teardown reconciler can reap the row to expired/deleted. The old unconditional UpdateDeploymentStatus would resurrect that reaped, over-TTL / over-cap workload back to building.

Fix

New models.MarkDeploymentBuilding performs the flip as a guarded CAS:

UPDATE deployments SET status='building', error_message=NULL, updated_at=now()
WHERE id=$1 AND status IN ('building','deploying','healthy','failed')

returning rows-affected — mirroring the existing CAS guards on MarkDeploymentTornDown and SetDeploymentTTL. Both handlers now branch on the result:

• 0 rows → 409 deployment_not_redeployable (reaped concurrently — do not re-arm)
• driver error → log + continue (non-determinate; runRedeployAsync reconciles status later)
• 1 row → proceed to async build

New metric label: instant_deploy_redeploy_total{outcome="not_redeployable"}.

Coverage block

Symptom:        redeploy resurrects an expired/deleted deploy back to 'building' (TOCTOU)
Enumeration:    grep "building" status flips in deploy.go + UpdateDeploymentStatus call sites
Sites found:    2  (in-place /deploy/new redeploy=true; POST /deploy/:id/redeploy)
Sites touched:  2
Coverage test:  TestMarkDeploymentBuilding_Branches (1-row / 0-row / driver),
                TestDeployNew_Redeploy_CASMiss_Returns409,
                TestDeployRedeploy_ByID_CASMiss_Returns409,
                TestDeployRedeploy_ByID_CASSuccess_Returns202,
                TestDeployRedeploy_ByID_CASDriverError_StillAccepts,
                TestDeployNew_Redeploy_UpdateStatusError_StillAccepts (updated)
Live verified:  awaiting post-merge auto-deploy (rule 14 build-SHA gate in CI)

100% patch coverage (every new branch in deploy.go + MarkDeploymentBuilding exercised). go vet clean; gofmt clean.

🤖 Generated with Claude Code