Deploy pipeline and development environment robustness

Goal: a deploy never fails late on something knowable early, and a dev stack or dev node comes up anywhere it should. - Fail in the develop gate (or before images are pushed) when main's plan changes the node-launcher IAM group, policy, user or membership; the message names the hand-apply step, documented once in infra/jaah/terraform/README.md § Deploy-role scope. - `./dc --profile node up` succeeds on pool hosts (repo.git untar fails on uid ownership today) so a seeded slot has a live dev node. - A self-hosted dev node outside the admin prefix list can fetch its one-liner, or Add node says what is needed (and shows the tailnet URL for nodes already on it). Out of scope: granting the deploy role IAM-group writes; production node packaging. Done means: a plan changing the launcher policy stops with the named message (test or dry run); on a fresh pool slot `./dc up && ./dc seed --dev && ./dc --profile node up` exits 0 and /nodes shows a live dev-node.

PR #6629 queued in the lane, quick gate + changed-area tests green. Deploy now stops before image push on a launcher-IAM plan (README hand-apply step); dev-node mirror untar fixed (seeded node live); Add node offers a tailnet line; order token line renamed so it is redacted. Visual check done. Memory: none applied.