feat(preview): add persistent tracked-branch environments

[samo-agent]

Closes #150.

What changed

• adds explicit standingPreview = true manifest/AppRecord opt-in for release-channel apps
• converges the tracked branch at the stable <app>-<branch-label>.samo.cat route
• creates on first cycle, redeploys on a new SHA, and no-ops when unchanged
• shares the existing batched preview SSH session and DBLab clone-healing path
• requires DNS plus a successful public HTTPS probe before stamping the deployed SHA
• makes a standing-preview failure fail the trigger cycle instead of hiding behind a green timer
• excludes the standing branch from PR-close, branch/TTL, and idle reapers; explicit env destroy remains available
• leaves apps without the opt-in unchanged

Why

Release-channel client apps need a stable review URL that continuously follows main, while production remains tag-gated. A manually-created main env was not enough: it did not update after merges and could be removed by TTL or idle cleanup.

Dependency

This composes with #133, which makes releaseTagPattern the production deploy source. The validation intentionally requires releaseTagPattern so tracked-branch review and production cannot accidentally be the same channel. Merge #133 before this PR.

Validation

• bun test: 1,785 pass, 0 fail
• bunx tsc --noEmit
• git diff --check
• dedicated acceptance coverage for manifest validation, create/update/no-op, honest failure state, trigger fail-red, PR/TTL/idle retention, DBLab healing, and one-session SSH batching