[green] Harden cache retirement and smoke rollback

[yyods]

Summary

• use exact Nginx cache-map keys for both retired unversioned social cards, including query variants
• route explicit post-activation smoke rejections through the rollback trap
• add regression contracts for both production failures

Evidence

• red commit reproduces both failures
• targeted deployment contract: 25/25 pass
• full web gate: 175 tests pass; formatting, lint, typecheck, website license audit, vinext check, Next build, and Sites build pass
• live origin and Cloudflare GET/HEAD verification: retired PNG and SVG return 404 with Cache-Control: no-store
• current release full production smoke passed and its activation watchdog was confirmed inactive

Scope

No firmware, app, protocol, or announcement claims change.