feat(atlas): Phase C — live CD/deploy state on stage 07

Stage 07 now shows the pod's own live deploy state — deployed image tag +
N/M replicas ready, green only when the rollout is fully ready — read from the
k8s Deployment in-cluster (new namespaced deployments-read Role). DeployState/
DeployNode test-first; prepended to the authored CD narrative, fallback-safe.

Verified: build/vet/lint(0)/test green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

internal/web/handler.go

@@ -55,6 +55,14 @@ func NewHandler() http.Handler {
 				}
 			}
 		}
+		if ld.deploy != nil {
+			node := atlas.DeployNode(*ld.deploy)
+			for i := range a.Stages {
+				if a.Stages[i].Generate == "deploy-state" {
+					a.Stages[i].Nodes = append([]atlas.Node{node}, a.Stages[i].Nodes...)
+				}
+			}
+		}
 		w.Header().Set("Content-Type", "application/json; charset=utf-8")
 		_ = json.NewEncoder(w).Encode(a)
 	})
@@ -63,9 +71,10 @@ func NewHandler() http.Handler {
 
 // liveOverlay holds cluster-sourced substrate facts (node specs + namespace line).
 type liveOverlayData struct {
-	hosts []atlas.Host
-	ns    string
-	run   *atlas.RunSummary
+	hosts  []atlas.Host
+	ns     string
+	run    *atlas.RunSummary
+	deploy *atlas.Deploy
 }
 
 // live cache: query the cluster at most once per TTL; fall back to the authored
@@ -102,6 +111,11 @@ func liveOverlay() liveOverlayData {
 			d.run = &r
 		}
 	}
+	if raw, err := cluster.Deployment(); err == nil {
+		if dep, err := atlas.DeployState(raw); err == nil {
+			d.deploy = &dep
+		}
+	}
 	liveCache = d
 	return d
 }