build: extend the main-sync gate to the image build and the k8s deploy

Same hazard as the package build, with the cluster on the receiving end: a
branch behind main builds images missing whatever landed there, and deploy-k8s.sh
pins that sha in Pulumi — making the stale build the cluster's source of truth.

build-mcpd.sh gets its own call because it is run standalone as well as from
deploy-k8s.sh, so neither can rely on the other having checked.

`--dry-run` is exempt. It builds and cuts over nothing, and blocking a read-only
inspection is exactly what teaches people to export MCPCTL_ALLOW_BEHIND_MAIN=1
permanently — which would disable the gate for the real deploys too.

The failure text is now artifact-agnostic ("produce an artifact" / "shipping
it"), since one helper now speaks for packages, images and deploys.

Verified against a synthetic ref one commit ahead: build-mcpd.sh exits 1 before
any docker work, and deploy-k8s.sh exits 1 before the test gate, the pg_dump,
the image build and pulumi. Neither the working tree nor HEAD was moved to test
this — the ref was built with git commit-tree and deleted afterwards.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019wUmrfkVQR6CKcYKxENq7k

scripts/check-main-sync.sh

@@ -84,8 +84,10 @@ check_main_sync() {
   echo "" >&2
   echo "ERROR: '$branch' is $behind commit(s) behind $base — refusing to build." >&2
   echo "" >&2
-  echo "  Building now would package a binary without these, and installing it" >&2
-  echo "  would overwrite a good one with a version missing them:" >&2
+  # Deliberately artifact-agnostic: the same helper gates RPM/DEB packages, the
+  # mcpd image, and the k8s deploy.
+  echo "  Building now would produce an artifact without these, and shipping it" >&2
+  echo "  would replace a good one with a version missing them:" >&2
   echo "" >&2
   git log --oneline --no-decorate "HEAD..$ref" | head -15 | sed 's/^/    /' >&2
   if [ "$behind" -gt 15 ]; then