Report Deployment Progress

The build controller reports progress. THE KEYSTONE (M9 item J2).

Without this, every deploy route below is inert. POST /deployments writes queued, and the state machine allows queued -> building -> promoting -> deployed. Nothing anywhere wrote building or promoting, so promote asked for queued -> deployed, which is illegal, and every real deployment that has ever existed 409s on promote while deployments/active returns null for every builder.

AUTHENTICATED AS THE CONTROLLER, NOT THE BUILDER, and that is the whole point. A builder's own key must not be able to walk their deployment to promoting with no build having run, then promote it: the machine would read green and the image would be whatever was there before, or nothing. So this route takes no user at all. See dependencies/build_controller_auth.py.

deployed IS NOT SETTABLE HERE. The controller knows when a build finished; it does not decide the app should take traffic. That is promote, a separate act by the builder. Collapsing them would let whichever pod ran the build put an app in front of users.

409 on an illegal transition rather than a silent no-op, so a controller that reports out of order learns it rather than leaving a deployment wedged in a state nobody wrote.

404 for an unknown deployment, and 404 for a wrong or absent controller token, deliberately indistinguishable. The controller is not a tenant and has no org, so there is no ownership check to make here: the deployment id is resolved against the control plane rather than trusted, and it is the only thing this credential can act on.