fix(infra): mypy 2.3 compat; _ReleaseContext.prod_branch; deny bare uv sync; telegram compose flag

Renames the smoke-replay loop variable mypy 2.3's stricter narrowing
rejects (the uv.lock bump made this the promotion blocker), renames
_ReleaseContext.default_branch to prod_branch to match what it holds
since the env ladder, extends the Makefile-gated guard to bare uv sync
on both runtimes (shared-cache poisoning is the race the guard exists
for), and lists ROBOCO_TELEGRAM_ENABLED in both compose files
(byte-identical).

tests/unit/services/test_release_executor.py

@@ -311,7 +311,7 @@ async def test_wait_for_ci_scoped_to_release_commit_not_branch_latest(
 
     ctx = _ReleaseContext(
         slug="roboco-api",
-        default_branch="master",
+        prod_branch="master",
         root=tmp_path,
         git_url="x",
         git_prefix=[],
@@ -362,7 +362,7 @@ async def test_wait_for_ci_polls_through_rerun(
 
     ctx = _ReleaseContext(
         slug="roboco-api",
-        default_branch="master",
+        prod_branch="master",
         root=tmp_path,
         git_url="x",
         git_prefix=[],
@@ -409,7 +409,7 @@ async def test_wait_for_ci_exhausts_window_on_persistent_failure(
 
     ctx = _ReleaseContext(
         slug="roboco-api",
-        default_branch="master",
+        prod_branch="master",
         root=tmp_path,
         git_url="x",
         git_prefix=[],
@@ -538,7 +538,7 @@ async def test_release_push_argv_uses_extraheader_not_url_token(
 
     ctx = _ReleaseContext(
         slug="roboco-api",
-        default_branch="master",
+        prod_branch="master",
         root=tmp_path,
         git_url=git_url,
         git_prefix=git_prefix,

tests/unit/services/test_release_executor_commit_fail_closed.py

@@ -16,7 +16,7 @@ from roboco.services.release_executor import _GitReleaseOps, _ReleaseContext
 def _ctx() -> _ReleaseContext:
     return _ReleaseContext(
         slug="roboco",
-        default_branch="master",
+        prod_branch="master",
         root=Path("/tmp/roboco-release-f012"),
         git_url="https://github.com/o/roboco",
         git_prefix=[],
@@ -32,7 +32,7 @@ class _FakeGitOps(_GitReleaseOps):
         # Bypass the real __init__ (no session needed) — we only exercise
         # commit_and_push, which calls self._git.
         self._slug = ctx.slug
-        self._default_branch = ctx.default_branch
+        self._default_branch = ctx.prod_branch
         self._root = ctx.root
         self._git_url = ctx.git_url
         self._git_prefix = ctx.git_prefix