Move the deploy pipeline's multi-line steps into tested scripts

[anth-volk]

Fixes #3894

Summary

Phase 1 step 1.7, part 2: the production deploy pipeline (push.yml). Stacked on the part 1 PR.

The seven remaining multi-line run: blocks become single-line steps:

Step(s)	Now runs	Notes
Build changelog	build_changelog.sh	towncrier for the pyproject.toml version; fails clearly if the version is missing
Run release tests	run_release_tests.sh	make test with the same env -u list of deployment settings removed
Compute Cloud Run staging/candidate metadata	compute_cloud_run_metadata.sh <prefix>	the same image_tag/revision_tag outputs (stg, stage3-prod)
Restore previous Cloud Run staging/production revision	restore_cloud_run_revision.sh <readiness-url>	rolls back, then health-checks; stops if the rollback fails
Install release test dependencies	two steps	apt-get update now has its own step

Every if:, env: and output name is unchanged. The multi-line baseline is now empty, so api.ci.multiline-run-is-script moves to enforced. Every workflow run: step in this repository is now a single line of code.

Updated existing tests: they asserted the old inline text, and keep the same intent and ordering:

• test_cloud_run_deploy_scripts.py: the release-test -u list and the "stage3-prod" tag.
• test_alembic_workflows.py: uv lock runs before the changelog build, and release tests run before deploy.
• test_app_engine_decommission.py: release tests run before deploy.

Testing

• New tests/unit/test_deploy_pipeline_scripts.py: 13 tests using fake towncrier, make and helper scripts. They assert exact arguments, outputs and exit codes, including failure paths.
• Full API unit suite (pytest tests/unit): 2,316 passed.
• python scripts/run_quality_guards.py: all three guards pass. guard --base-ref ci-scripts-exceptions passes.
• actionlint, ruff format/ruff check and shellcheck are clean.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 87.56%. Comparing base (95427f1) to head (0ff411d).

Additional details and impacted files

@@                    Coverage Diff                     @@
##           ci-scripts-exceptions    #3896       +/-   ##
==========================================================
+ Coverage                  45.22%   87.56%   +42.33%     
==========================================================
  Files                        183      198       +15     
  Lines                      11073    12211     +1138     
  Branches                    1905     2159      +254     
==========================================================
+ Hits                        5008    10692     +5684     
+ Misses                      5644      922     -4722     
- Partials                     421      597      +176     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.