fix(infra): mypy 2.3 compat; _ReleaseContext.prod_branch; deny bare uv sync; telegram compose flag

Renames the smoke-replay loop variable mypy 2.3's stricter narrowing
rejects (the uv.lock bump made this the promotion blocker), renames
_ReleaseContext.default_branch to prod_branch to match what it holds
since the env ladder, extends the Makefile-gated guard to bare uv sync
on both runtimes (shared-cache poisoning is the race the guard exists
for), and lists ROBOCO_TELEGRAM_ENABLED in both compose files
(byte-identical).

tests/unit/llm/providers/test_grok_raw_pm_deny.py

@@ -16,6 +16,7 @@ from roboco.llm.providers.grok_cli_config import _RAW_PM_DENY, _deny_rules
 def test_raw_pm_deny_rules_present() -> None:
     rules = _deny_rules("developer")
     assert "Bash(uv run*)" in rules
+    assert "Bash(uv sync*)" in rules
     assert "Bash(uv pip install*)" in rules
     assert "Bash(pip install*)" in rules
     assert "Bash(conda install*)" in rules