feat: gated deploy with preview, audit log, rollback trail (stage 4)

- pulp_client: create_publication / update_distribution / wait_for_task
- GET /repos/{uuid}/deploy/confirm: 미리보기(현재→대상, 순 변화) + type-to-confirm 모달
- POST /repos/{uuid}/deploy: 검증 게이트(서버측 재확인) → publication 생성 →
  distribution 교체 → 감사 로그. 2단계 실패 시 '운영망 변경 여부' 명확화
- audit.record_deploy: 누가/언제/repo/이전버전→대상버전 JSONL (롤백 추적)
- 배포 버튼은 검증 통과 + 미배포 버전만 활성, 성공 시 버전목록 OOB 갱신
- 인증은 TODO (operator placeholder, 배포 비밀번호 재확인 예정)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/test_pulp_client.py

@@ -61,3 +61,43 @@ def test_get_task_returns_state():
     with PulpClient() as pulp:
         task = pulp.get_task("/pulp/api/v3/tasks/t1/")
     assert task["state"] == "running"
+
+
+@respx.mock
+def test_create_publication_posts_version_and_returns_task():
+    import json
+
+    route = respx.post(f"{PULP_TEST_URL}/pulp/api/v3/publications/rpm/rpm/").mock(
+        return_value=httpx.Response(202, json={"task": "/pulp/api/v3/tasks/p1/"})
+    )
+    vh = "/pulp/api/v3/repositories/rpm/rpm/abc/versions/3/"
+    with PulpClient() as pulp:
+        href = pulp.create_publication(vh)
+    assert href == "/pulp/api/v3/tasks/p1/"
+    assert json.loads(route.calls.last.request.content) == {"repository_version": vh}
+
+
+@respx.mock
+def test_update_distribution_patches_publication_and_returns_task():
+    import json
+
+    dist = "/pulp/api/v3/distributions/rpm/rpm/d1/"
+    route = respx.patch(f"{PULP_TEST_URL}{dist}").mock(
+        return_value=httpx.Response(202, json={"task": "/pulp/api/v3/tasks/d1/"})
+    )
+    with PulpClient() as pulp:
+        href = pulp.update_distribution(dist, "/pulp/api/v3/publications/rpm/rpm/p1/")
+    assert href == "/pulp/api/v3/tasks/d1/"
+    assert json.loads(route.calls.last.request.content) == {
+        "publication": "/pulp/api/v3/publications/rpm/rpm/p1/"
+    }
+
+
+@respx.mock
+def test_wait_for_task_returns_on_terminal_state():
+    respx.get(f"{PULP_TEST_URL}/pulp/api/v3/tasks/t1/").mock(
+        return_value=httpx.Response(200, json={"state": "completed"})
+    )
+    with PulpClient() as pulp:
+        task = pulp.wait_for_task("/pulp/api/v3/tasks/t1/", attempts=1, delay=0)
+    assert task["state"] == "completed"