test(matrix): deploy-lifecycle block integration tests (move exempt→mapped)

[mastermanas805]

What

Closes the deploy-lifecycle routes in the done-bar guard's
routeCoverageExemptions with real DB-backed integration tests and moves
them exempt→mapped. Follows #249 (the guard) and #250 (team/member block);
reuses the ../handlers mapped-test-dir scanning #250 introduced.

USER-FLOW-INVENTORY-AND-TEST-MATRIX.md (2026-06-04) §D rows D5–D10.

Routes moved (routeCoverageExemptions → routeTestMap)

Route	Covering test
GET /api/v1/deployments/:id/events	TestDeployLifecycle_Events_Timeline_OwnerReadsDescOrder
PATCH /deploy/:id/env	TestDeployLifecycle_UpdateEnv_MergesAndRedacts
POST /deploy/:id/redeploy	TestDeployLifecycle_Redeploy_HealthyRow_Accepts202
PATCH /api/v1/deployments/:id	TestDeployLifecycle_Patch_Pro_SetsPrivate
POST /api/v1/deployments/:id/make-permanent	TestDeployLifecycle_MakePermanent_HappyPath
POST /api/v1/deployments/:id/ttl	TestDeployLifecycle_SetTTL_HappyPath

Counts: 85→91 mapped, 86→80 exempt (net 6 moved). The
/api/v1/deployments/:id/github rows stay exempt (D17 / W6 github-app flow);
GET /approve/:token stays exempt (no integration cover yet).

New suite

internal/handlers/deploy_lifecycle_block_integration_test.go — 12 tests.
DB-backed via testhelpers.SetupTestDB + NewTestAppWithServices (the
production RequireAuth chain against a real Postgres). Reuses existing
helpers (seedInternalDeploy, MustCreateTeamDB, MustSignSessionJWT,
models.UpdateDeploymentProviderID) — no helper redefinition.

Cross-cutting matrix asks covered: create→accepted (202), status/events read
(timeline DESC), redeploy CAS (healthy→202 / terminal→409), tier-gating
(hobby PATCH private→402 + agent_action), authz/cross-team (404 not 403 on
events / env / make-permanent), bounds (TTL out-of-range→400). Heavy
Kaniko-build legs assert the accepted/contract surface (noop compute), not a
live build — deferred to the W4 e2e specs.

Gates

• Both done-bar guards green: TestDoneBar_EveryRouteCovered +
  TestDoneBar_TestMapPointsAtRealTests.
• New suite green against the test DB; internal/handlers + internal/router
  green under make gate. The only red in the full ./... local run is the
  pre-existing internal/models/TestLinkGitHubID UUID-ordering flake (verified
  identical on clean origin/master with this PR's files stashed) — CI
  authoritative.
• Test-only PR (new test file + guard-map move); no handler-source edits.

🤖 Generated with Claude Code