Prevent deployment cache from crossing shadow and enforce policies

[aruintelligence]

What changed

The deployment cache previously keyed a result by intent, profile, context, and timestamp, but omitted rollout mode and failure mode. A suppressed intent evaluated in shadow could be returned by a later enforce call as effective_allowed: true. An explicit cache_key also replaced the input identity entirely, allowing different intents to share a result.

This change binds cache entries to the canonical snapshot actually evaluated: intent, profile, context, fixed timestamp, audit stream ID, mode, failure mode, and optional operator namespace. Manual keys cannot substitute for a fixed timestamp. Cache lookup/storage failures leave the computed decision intact.

Reproduction and verification

• Before: shadow suppressed intent → enforce of the same intent returned mode: "shadow", effective_allowed: true, cache.hit: true.
• After: enforce returns mode: "enforce", effective_allowed: false; separate cache entries preserve repeat hits within each mode.
• Added regression cases for manual-key collisions, context and stream separation, input snapshot consistency, dynamic time, and cache outage behavior.
• node --test test/deployment-firewall.test.js test/rollout-runtime.test.js — 21 passed.
• node --test --test-reporter=dot — passed.
• node scripts/check-deployment-surfaces.mjs, node examples/deployment-rollout.mjs, node scripts/check-api-stability.mjs, git diff --check — passed.

The tests and behavior here are project-authored engineering evidence. This does not claim independent validation or production suitability.