Verify the UI host's effective feature flags during rollout #4853

🤖 Generated by the Agentic Engineer

Problem and evidence

The Data Products rollout verifier checks immutable images, ownership and readiness, but its runtime environment projection omits the UI host's contract, appearance and publisher flags. A Deployment or serving Pod can therefore disagree with the checked-out UI configuration while still passing that receipt. This was found while preparing publisher availability in #4852; no production flag mismatch is asserted.

Outcome

A successful UI rollout receipt binds the declared feature configuration to the exact ready UI host and its current serving Pods.

Acceptance

• Resolve expected UI flags from the checked-out host declaration; reject duplicates, indirect values and unsupported literals.
• Verify the UI host Deployment and each current serving Pod against those expectations without changing the existing controller environment checks.
• Preserve absent and explicit-false publisher withdrawal profiles and the existing snapshot, deadline, ownership, digest and sanitization boundaries.
• Prove RED/GREEN for mismatched Deployment/Pod flags, and retain positive coverage of the currently deployed release.
• Validate both rendered platform overlays and the existing Data Products regressions; drive the repair through the normal reviewed production queue.

Part of #4852. This verification repair is independently deliverable against the existing signed v2.7.0 deployment; it does not enable publisher review or require the pending source release.

Planning: Medium priority prevents a false rollout success in the publisher-adoption path. Low effort covers a bounded projection/predicate change and meaningful negative controls. Standard service class; unblocked Ready work under the maintainer's WIP waiver.