fix(infra): mypy 2.3 compat; _ReleaseContext.prod_branch; deny bare uv sync; telegram compose flag

Renames the smoke-replay loop variable mypy 2.3's stricter narrowing
rejects (the uv.lock bump made this the promotion blocker), renames
_ReleaseContext.default_branch to prod_branch to match what it holds
since the env ladder, extends the Makefile-gated guard to bare uv sync
on both runtimes (shared-cache poisoning is the race the guard exists
for), and lists ROBOCO_TELEGRAM_ENABLED in both compose files
(byte-identical).

tests/unit/services/test_release_executor.py

@@ -311,7 +311,7 @@ async def test_wait_for_ci_scoped_to_release_commit_not_branch_latest(
 
     ctx = _ReleaseContext(
         slug="roboco-api",
-        default_branch="master",
+        prod_branch="master",
         root=tmp_path,
         git_url="x",
         git_prefix=[],
@@ -362,7 +362,7 @@ async def test_wait_for_ci_polls_through_rerun(
 
     ctx = _ReleaseContext(
         slug="roboco-api",
-        default_branch="master",
+        prod_branch="master",
         root=tmp_path,
         git_url="x",
         git_prefix=[],
@@ -409,7 +409,7 @@ async def test_wait_for_ci_exhausts_window_on_persistent_failure(
 
     ctx = _ReleaseContext(
         slug="roboco-api",
-        default_branch="master",
+        prod_branch="master",
         root=tmp_path,
         git_url="x",
         git_prefix=[],
@@ -538,7 +538,7 @@ async def test_release_push_argv_uses_extraheader_not_url_token(
 
     ctx = _ReleaseContext(
         slug="roboco-api",
-        default_branch="master",
+        prod_branch="master",
         root=tmp_path,
         git_url=git_url,
         git_prefix=git_prefix,