deployment-scoped artifacts and reporting epic

[dannash100]

Epic branch for deployment-scoped artifacts. Implementation PRs merge here rather than into main.

• Merges feat(platform): D2: spec deployment-scoped artefacts #529's spec onto current main. That branch sat 247 commits behind, and two of its links pointed at files main has since renamed (device-identity.md, servers/products.md).
• Settles the review points still open on it: the digest is verified as the bytes arrive as well as when they are served, and artefact is spelled artifact to match the code.
• First implementation branch is feat/group-scoped-artifacts.

🦸 Review Hero

• Run Review Hero

[dannash100]

🤖 Sequencing note, since two follow-ups hang off one step that is easy to miss.

bes-canopy-api publishes when the release-plz release PR merges, not when this stack lands on main. Landing on main is what opens that PR; merging it is what cuts the crate. No manual version bump, release.yml writes the number back into openapi.rs itself.

Waiting on that publish:

• pgro: move the build outcome out of the free-form health_details blob into the typed reporting_schema field on the verification report. Until then canopy writes no reporting_schema_builds row, so no pair settles, the worklist re-dispatches every pair on every poll, and a failed build raises nothing.
• bestool: grade on Artifact.digest as well as the version. That field is new in this stack, so alertd cannot read it until the crate publishes. Without it, a rebuild of the same Tamanu version never reaches servers and the check reads pass, which is the common case: report fixes land mid-version fairly often.

[dannash100]

🤖 The dbt side is written: tamanu-source-dbt#1336 (entrypoint, image, reusable workflow, and a fix for a failed survey listing returning []) and tamanu-dbt-template#30 (the caller). Three smaller ones are merged there already.

Two corrections to the contract in the handover doc, both found by running it:

• The build writes to the replica. ds__invoice_products and invoice-products-summary pivot a table into columns and read it with run_query while they compile, and pgro drops the reporting schema during the migration, so the build runs dbt run rather than dbt compile. pgro needs no change for this: the build Job already gets the analytics user the migration runs its DDL under, and effective_read_only is false for any restore carrying migrate_to.
• generate_translation_macro() has to run first. get_translations() is generated rather than committed and macros/translations.sql calls it, so nothing compiles without it.

Run against a Tamanu schema in a container it produces a real artifact: 180 views, stamped with the version it was told to build for, no transaction control. The callback was exercised over HTTP too: raw SQL body, 503 retried then 204.