#1056 Manual deploy of a5d4f45 to vm-1 (director-approved stopgap until CI G15)

EARS SPEC: - When the director approves a manual deploy (2026-10-23), the operator shall build highway-workflow-engine and highway-dsl-compiler on vm-1 from a fresh clone of highway a5d4f45 (engine 826c472, jumper 33e4087) with the frozen uv.lock, labelled org.opencontainers.image.revision and pipeline 3819. - The deploy shall follow SPECS/deploy-first-ci-build.md and SPECS/924-remove-vault.md runbook steps 1-9, except that the image is built locally instead of pulled from containers.rodmena.co.uk. - If /etc/highway/secrets/platform holds pg-nano (#925) credentials whose values differ from the live DB credentials, then the operator shall move them out before the platform directory is mounted, and restore them only at the #925 cutover. - Before migrations run, the operator shall take a pg_dump of highway_db_v2 and keep the previous image (d89b53be6d9f, e58c57d) tagged for rollback. - After the restart, GET and HEAD /api/v1/health over https://highway.rodmena.co.uk shall return 200, and the live checkers in SPECS/deploy-first-ci-build.md step 5 shall report 0 failures. - The database shall stay on highway-postgres; the pg-nano cutover (#925) is out of scope. SYNTHESIS: release engineering; concept = immutable build of one commit, deploy by image id, staged restart with rollback (runbook already specified). Alternative CI-built pull by digest rejected for now: G15 not available before 2026-10-26 (ci-conductor 01M5ND4STQ7RAH0MM9X526XJQP).