ci(pact): record production deployments + shadow can-i-deploy

Adds the missing record-deployment half of the Pact can-i-deploy loop and
stops can-i-deploy from failing every merge while the broker's production
environment is still empty.

- New pact-record-deployment.yml: on tag push, records a production
  deployment of nextcloud-mcp-server keyed by the tagged commit SHA, which
  matches the SHA pact.yml publishes consumer pacts / verification results
  with. Recording the tag string would not link to the verified pacts.
- pact.yml can-i-deploy: wrapped in shadow mode (runs for signal, emits a
  warning annotation on failure, always exits 0). can-i-deploy cannot pass
  until both nextcloud-mcp-server and astrolabe have recorded a production
  deployment, so gating now would block merges on a bootstrap gap.

Tracked on Deck card #325. Promotion to a hard gate is a follow-up.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.github/workflows/pact.yml

@@ -149,9 +149,18 @@ jobs:
           curl -fsSL https://raw.githubusercontent.com/pact-foundation/pact-ruby-standalone/f03e620e7552239b6ca59438c9beed9d1038c949/install.sh | bash # v2.6.1
           echo "$PWD/pact/bin" >> "$GITHUB_PATH"
 
-      - name: Can I deploy nextcloud-mcp-server?
+      # SHADOW MODE: run can-i-deploy for signal but never fail the workflow.
+      # The broker's `production` environment is populated by the
+      # pact-record-deployment workflow on each repo's next release; until both
+      # nextcloud-mcp-server AND astrolabe have recorded a prod deployment this
+      # check cannot pass, so gating now would block every merge on a bootstrap
+      # gap rather than a real incompatibility. Once it reports ✅ in both repos,
+      # promote to a hard gate by removing the `set +e`/`exit 0` wrapper and
+      # relocating it ahead of the deploy step (see card #325 follow-up).
+      - name: Can I deploy nextcloud-mcp-server? (shadow — non-blocking)
         if: ${{ env.PACT_BROKER != '' }}
         run: |
+          set +e
           pact-broker can-i-deploy \
             --broker-base-url "$PACT_BROKER" \
             --broker-username "$PACT_USERNAME" \
@@ -159,3 +168,10 @@ jobs:
             --pacticipant nextcloud-mcp-server \
             --version "${{ github.sha }}" \
             --to-environment production
+          rc=$?
+          if [ "$rc" -ne 0 ]; then
+            echo "::warning title=can-i-deploy (shadow)::can-i-deploy exited $rc — NOT gating (shadow mode). Expected until both repos record a production deployment; see Deck card #325."
+          else
+            echo "can-i-deploy passed ✅ (shadow mode — not yet gating)"
+          fi
+          exit 0