Issues Promotion Readiness

May production be promoted right now, and if not, what is holding it.

Called by tools/rooster_worker/drain.py's promote_pass before it touches Railway. The decision lives here, next to the statuses it reads, rather than in the worker: the worker knows how to deploy, not who is owed a verification.

may_auto_promote is the whole answer. blocked_by exists so a hold is never silent -- fifteen fixes once parked at fix_staged and the board looked healthy, which is the failure this endpoint is part of removing.