fix: select the approved Ready revision for traffic promotion

[Pigbibi]

Summary

• keep exact commit identity validation during Cloud Run traffic promotion
• when configuration sync creates a newer Ready revision with an older commit label, select the newest Ready revision that matches the approved commit
• fail closed when no Ready revision matches

Verification

• 24 deployment reconciliation tests passed
• Ruff passed
• git diff --check passed

Incident evidence

Production run 36250532668 built and verified the approved image, then failed traffic promotion because latestReadyRevisionName pointed at the configuration-sync revision labeled with the previous commit.