📝 docs: worklog — record merge, deploy and production verification

[flupkede]

What

Brings docs/federated-silent-poll/worklog.md to ground truth. It still said "Not pushed. Three commits sit locally" while the work was merged (#192) and running in production. A change record that is wrong is worse than none.

Changes

• Header — status is now shipped + verified, with the merge SHA (b6cb48f) and the deployed revision (codesearch-serve--0000024); the test line records CI green rather than only the local run.
• Stage 4 added — the branch had no CI at all until fix/** was added to ci.yml's prefix allowlist, including the self-test that proved it (08276de → CodeQL only; 4add0d1 → CI + CodeQL).
• Stage 5 added — deployment of both sides and the production verification: the replica scaled to 0 about ten minutes after deploy and stayed at 0 across six consecutive one-minute checks with no traffic. Recorded as positive evidence, not just absence of symptoms — under the old binary most_recent_tool_call() would have been None, fallen back to the process start time, and self-pinged every 120 s for the full 30-minute idle window, so reaching 0 at ten minutes was not possible.
• Config verified across the image update: 12 env vars, 4 secretRefs, CODESEARCH_IDLE_SUSPEND_SECS=1800. Registry size 160,647,888 B vs 160,629,714 B previously — 18 KB apart, so no size regression.
• Build note — two az acr build runs failed at the identical step (COPY --from=builder /models.tar.gz) with failed to export image: ... layer does not exist. Layer digests differed between runs so it was not a poisoned cache, and the Dockerfile is byte-identical to the one that built the previously deployed image. Root cause is the ACR Tasks build agent, not this repo; a local docker build + docker push succeeded first time.

Follow-ups adjusted

• Dropped the stale "not pushed" item.
• The production check is now "re-run the Log Analytics query over a full day" rather than "unverified" — the six-minute window proves the self-ping is gone, but only a 24 h sample proves nothing else wakes the peer.
• Added the ACR Tasks failure as a blocker for anyone automating the cloud deploy.

Docs-only, so the pre-push QC gate correctly skipped.