Prod changeset sync — Stage 2: app cutover (configmap, SA, image pin, runbook)

[arielr-lt]

Stage 2 (app cutover) for registry changeset sync in production. Depends on Stage 1 (#1061, infra — already applied). Draft — do not merge/apply until the deploy window.

Changes (k8s-manifests-prod/)

• app-configmap: add REGISTRY_CHANGESET_SYNC_* + AWS_REGION. REGISTRY_CHANGESET_SYNC_ENDPOINT intentionally omitted — changesets generate + store in S3 but aren't delivered, so the Publisher blob can be backfilled first; endpoint is set afterward.
• app-service-account: repoint to the dedicated least-privilege ce-registry-eks-prod-application-irsa-role (verified: db-dump jobs use a separate SA, so nothing loses bucket access).
• app/worker/db-migrate: pin immutable image 2026.07.30.0154 (was floating :master/:production). Tag verified in ECR.
• RUNBOOK: full ordered cutover (marker reset → apply SA+configmap → Deploy workflow + migration → verify → set endpoint after backfill) + rollback notes.

Key deploy facts

• Marker reset needed for ce_registry only (stale row ~89K versions behind); other communities self-initialize on first publish. Reset runs first (image-independent) to pre-empt the ~180 MB backlog ZIP under the publish-lock.
• The Deploy image workflow runs the migration after the rollout, so new pods (which don't use the Argo columns) are up before RemoveArgoFields drops them.
• Configmap + SA are not applied by the Deploy workflow — applied separately per the runbook.

Not in this PR

• Setting REGISTRY_CHANGESET_SYNC_ENDPOINT (post-backfill, via configmap workflow).
• Publisher-side blob backfill (Cary) + accumulated-changeset apply.