fix: explicit single-target image-only no-traffic staging

[Pigbibi]

Scope

• Add an opt-in, non-matrix PAPER/HK/SG image-only staging job. Require approved workflow ref, workflow SHA, and checked-out source SHA to match.
• Build only tracked source via git archive, resolve an immutable image digest, and update only the existing service image/source labels with --no-traffic. No environment, secret, IAM, scheduler, strategy, or cleanup changes.
• Skip legacy deployment and downstream lifecycle matrix publication for this mode; preserve legacy/manual/scheduled behavior.
• Add real local command-stub regressions to the existing shell test and wire it into CI. Correct three pre-existing stale binding assertions.

Verification

• Tests-first RED: missing job; workspace build and mismatched workflow SHA; missing lifecycle exclusion.
• GREEN: 21 actual shell command/negative/no-retry cases and 6 lifecycle-expression cases.
• Four relevant existing Python test files: 17 passed.
• actionlint (three changed workflows), bash -n, and git diff --check passed.
• No real cloud/provider/broker call or deployment performed. Push/main CI cannot dispatch deployment.

Operational boundary

--no-traffic preserves serving revisions and percentages but pins any LATEST selector to its current revision. Cloud readiness and runtime/order state remain unverified; actual deployment requires separately authorized, single-target execution.