feat: prepare guarded framework Pages cutover

[CircleQMinh]

Summary

• add guarded manual selection between framework deployment and SPA rollback
• require explicit production deployment confirmation on main
• retain an exact deploy-ready SPA rollback snapshot for seven days
• validate the custom-domain CNAME in source and both build outputs
• update project guidance and the SEO handoff for the cutover workflow

Safety

• this PR does not deploy anything
• the Pages workflow remains manual-only
• every confirmed run validates both the SPA and framework outputs
• only the selected public output is uploaded to Pages
• Cloudflare configuration is unchanged

Validation

• deployment workflow policy assertions passed
• lint passed
• 17 tests passed
• SPA and framework production builds passed
• framework finalization and validation passed
• 227 sitemap routes returned direct local 200 responses
• excluded and invalid routes used the dedicated noindex 404 response
• browser rerun was unavailable because the Playwright service usage limit was exhausted; no application runtime files changed