feat(reliability): add production runtime canary policy

[Yevanchen]

Summary

• Add a secret-protected internal diagnostic that verifies two canary Runs stayed on the same driver without exposing driver IDs publicly.
• Reuse the existing constant-time internal-secret comparison for the Lark sidecar and status canary routes.
• Document the five-minute production canary, 99.5% SLO, three-breach release freeze, and one-page incident postmortem discipline.

Why

Production regressions such as #431 can pass staging but break follow-up driver continuity. This gives the public website canary one narrow, authenticated signal for that production-only failure mode.

Validation

• just test-file apps/api/tests/status-canary-internal-route.test.ts
• just tc-package @mosoo/api
• just lint
• just docs-check
• just commit-check
• just check reached 1080 passing tests and failed only the unrelated existing macOS /var vs /private/var assertion in apps/driver/tests/acp-file-system.test.ts; the focused failure reproduces without touching this PR's API path.

Generated and migration state

• GraphQL codegen: not applicable
• D1 migrations: none
• Generated files: none
• Lockfile changes: none