Deploy pipeline integrity

Sorting agent tasks by cost-to-undo decides how much work the agent does alone

One developer's cache-header diff read perfectly and still shipped a dead year-long cache, which is the argument for granting agents autonomy only where git revert plus a redeploy is the whole undo path.