fix(teach-deploy): keep --dry-run read-only in CI mode; merge with --no-ff

[Data-Wise]

Two fixes to teach deploy, both found by trying to drive it from a non-interactive caller.

1. --dry-run was neither read-only nor usable in CI mode

ci_mode auto-detects whenever stdin is not a TTY (teach-deploy-enhanced.zsh:530), so every
automation or agent caller gets it. In that mode two preflight conditions aborted the run before
the plan could render:

• "production has new commits" (:170-186)
• "uncommitted changes" (:668)

Neither can affect a dry run, which mutates nothing. Both teaching repos I tested hit the first
one, so a dry run could not render a plan on the ordinary state of a working course repo.

The uncommitted-changes handler had a worse edge. Interactively it prompts to commit, and any
pty wrapper answers the default Y. Probing whether script -q /dev/null could defeat the CI-mode
detection, it did exactly that and created a real commit in a live course repo during what was
announced as a read-only dry run. That commit was reverted and the repo restored, but the hazard is
in the handler, not in the wrapper — which is why the fix is here rather than a note telling people
not to use a pty.

Both mutation-oriented gates now skip when dry_run is true. Real deploys are untouched and still
abort on both conditions.

2. The direct merge omitted --no-ff

A deploy of N draft commits fast-forwarded production to draft's own tip, leaving no single commit
representing the deploy. Since teach deploy --rollback reverts the deploy's commit, a
fast-forwarded deploy could only be rolled back one commit at a time — it lost rollback granularity
silently rather than failing. git-helpers.zsh:693 already assumed otherwise, filtering "merge
commits from --no-ff deploys" when detecting production conflicts.

Verified in a sandboxed fixture deploying two commits:

before:  linear history, production tip == draft's own content commit
after:   70c864d parents=[d7a7215 6f52c5f]   (a merge commit)

Test evidence

All 8 deploy suites: 246 passed, 1 failed, 1 skipped.

dogfood-teach-deploy-v2.zsh              71/71 passed
e2e-teach-deploy-v2.zsh                  44 passed, 0 failed, 1 skipped
test-teach-deploy-dryrun-readonly.zsh    10 passed, 0 failed   (new)
test-teach-deploy-merge-topology.zsh      2 passed, 0 failed   (new)
test-teach-deploy-unit.zsh               25 passed, 1 failed   <- see below
test-teach-deploy-v2-integration.zsh     22 passed, 0 failed
test-teach-deploy-v2-unit.zsh            58 passed, 0 failed
test-teach-deploy.zsh                    14 passed, 0 failed

The single failure is Test 24: Calculate commit count between branches, and it reproduces
identically on unmodified dev — pre-existing, not introduced here.

Both new suites check repository state before and after every case, so any write during a
"read-only" path is caught rather than assumed.

Positive controls, run separately for each fix:

• Reverting only the dry-run change fails exactly the 3 dry-run assertions while all 4
  real-deploy controls still pass — so the controls are not tautological.
• Reverting only the --no-ff fails both topology assertions; restoring it passes both.

One trap documented in the test header

After a successful deploy, draft and production legitimately point at the same commit, because
the deploy syncs draft from production afterwards (draft@{0}: merge origin/production: Fast-forward). Ref equality is therefore not evidence of a fast-forwarded deploy — parent
count is. An earlier check of mine got this wrong and reported a fast-forward that had not
happened.

Changelog

Both CHANGELOG.md and docs/CHANGELOG.md updated under [Unreleased]. Note the two files
already differ by roughly 20KB of pre-existing drift; these entries are mirrored into both rather
than reconciling that separately.

Context

Found while making cc-config's /deploy delegate here instead of reimplementing the
draft-to-production workflow itself (cc-config#7). That delegation stays unshipped until this
lands and a release reaches Homebrew, since teach resolves to the brew build.