docs(ops): cutover runbook drift found during the real cutover

[themightychris]

Things the 2026-09-17 cutover did differently from `docs/operations/cutover.md`, to fold back in:

• Certs are pre-issued, not issued at the flip. `mergeGateways: true` allows a hostname on one :443 listener cluster-wide, so we declared explicit `Certificate`s in `codeforphilly-ng` (cfp-live-cluster #195) before moving the listeners and the flip was instant. T-0 step 2 still says "allow a minute or two for ACME".
• The ConfigMap change does not roll the pod. `CFP_SITE_HOST` comes via `envFrom` on a static ConfigMap; a `kubectl rollout restart` was needed after the apply. T-0 step 2 says the change "rolls the pod (Recreate strategy)".
• The T-1 data refresh needs a spam-evaluation step for the delta (see the sibling issue), otherwise unevaluated signups reach `published`.
• Post-flip: drop the explicit Certificate declarations so cert-manager's gateway-shim adopts the existing Secrets (tracked in cfp-live-cluster).

🤖 Generated with Claude Code

https://claude.ai/code/session_01LFyA5poHwrhAktrnsKrUiQ