feat(atlas): Phase C — live CD/deploy state on stage 07

Stage 07 now shows the pod's own live deploy state — deployed image tag +
N/M replicas ready, green only when the rollout is fully ready — read from the
k8s Deployment in-cluster (new namespaced deployments-read Role). DeployState/
DeployNode test-first; prepended to the authored CD narrative, fallback-safe.

Verified: build/vet/lint(0)/test green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

internal/atlas/cluster_test.go

@@ -98,6 +98,38 @@ func TestNamespaceSummary_CapsWithMore(t *testing.T) {
 	}
 }
 
+func TestDeployState_ParsesImageAndReplicas(t *testing.T) {
+	dep := []byte(`{"spec":{"replicas":2,"template":{"spec":{"containers":[
+	  {"name":"cad-atlas","image":"localhost:5000/cad-atlas:3ff922a"}]}}},
+	  "status":{"readyReplicas":1,"replicas":2}}`)
+
+	d, err := atlas.DeployState(dep)
+	if err != nil {
+		t.Fatalf("DeployState: %v", err)
+	}
+	if d.Image != "localhost:5000/cad-atlas:3ff922a" || d.Ready != 1 || d.Desired != 2 {
+		t.Fatalf("deploy = %+v", d)
+	}
+	if d.Tag() != "3ff922a" {
+		t.Fatalf("tag = %q, want 3ff922a", d.Tag())
+	}
+}
+
+func TestDeployNode_GreenOnlyWhenFullyReady(t *testing.T) {
+	ready := atlas.DeployNode(atlas.Deploy{Image: "localhost:5000/cad-atlas:abc", Ready: 1, Desired: 1})
+	if ready.Pill != "var(--green)" {
+		t.Fatalf("ready pill = %q, want green", ready.Pill)
+	}
+	if ready.Title != "◆ deployed · cad-atlas:abc · 1/1 ready" {
+		t.Fatalf("title = %q", ready.Title)
+	}
+
+	rolling := atlas.DeployNode(atlas.Deploy{Image: "x/cad-atlas:def", Ready: 0, Desired: 1})
+	if rolling.Pill != "var(--amber)" {
+		t.Fatalf("rolling pill = %q, want amber", rolling.Pill)
+	}
+}
+
 func TestHostsFromNodes_ErrorsOnBadJSON(t *testing.T) {
 	if _, err := atlas.HostsFromNodes([]byte("{not json")); err == nil {
 		t.Fatal("expected error on bad JSON, got nil")