docs(codeq): execution-era CODEQ_DEPLOYMENT.md sections (#25–#29)

[Kenny-Heitritter]

What

Adds the execution-era sections to CODEQ_DEPLOYMENT.md, on top of the anchor doc published in #30 (#23). One commit per ticket, appended in dependency order:

• Layer-2 running-pod refresh policy — closes Execution: document running-pod convergence window + break-glass drain (layer 2) #27 (convergence SLA: staging 30 min / prod 45 min idle-cull, no max-server-lifetime cap; security break-glass drain runbook; deliberate no-banner / no-auto-drain).
• System-owned config fields registry — doc portion of Execution: config-fields registry + update-codeq-token.sh restructure & reconcile (layer 3) #26 (fields Dstacks re-asserts, user-owned fields it must not touch, retired-ids list, scoped contract, release-checklist line). Paired script work: qBraid/qbraid-Dstacks PR.
• Rollout smoke-test — doc portion of Execution: rollout smoke-test — in-build fail-closed SHA gate + operator verify one-liner #25 (verify one-liner + pass/fail criterion). Paired infra work: qBraid/qbraid-infrastructure PR.
• Staging auto-rebuild — doc portion of Execution: enable staging auto-rebuild (codeq push → build-lab-base, scoped IAM) #28. Paired infra work: same infra PR.
• Prod go-live checklist — doc portion of Execution: wire prod auto-rebuild (gated-off) + verify prod bucket versioning + go-live checklist #29 (wired-but-disabled). Paired infra work: same infra PR.

Merge order

Stacked on #30 (base = docs/codeq-deployment-anchor). Merge #30 first; GitHub will retarget this PR to dev.

Notes

• Doc-only. Execution: document running-pod convergence window + break-glass drain (layer 2) #27 is fully satisfied here. Execution: rollout smoke-test — in-build fail-closed SHA gate + operator verify one-liner #25/Execution: config-fields registry + update-codeq-token.sh restructure & reconcile (layer 3) #26/Execution: enable staging auto-rebuild (codeq push → build-lab-base, scoped IAM) #28/Execution: wire prod auto-rebuild (gated-off) + verify prod bucket versioning + go-live checklist #29 also have cross-repo code changes tracked in their infra/Dstacks PRs — this PR carries only their doc portions and does not close them.

Closes #27. Part of #16.