docs(deploy): record what stretches a release into a window

[simonvanlierde]

Three failure modes hit during an ownership migration, written into the runbook so the next one does not rediscover them.

• A backfill migration holds the API down for its whole duration. The migrations profile gates the API on service_completed_successfully; a migrator that regenerates derivatives keeps the API and the tunnel in Created until it exits.
• The safety snapshot needs the stack up and must precede the checkout. backup runs with --no-deps by design, so it cannot follow down; and the Compose user: pin overrides the image's USER, so between a checkout and the matching chown every backup run fails. Adds the ordering that works.
• Restart every timer stopped for the window. A stopped watchdog cannot report that the others are still stopped; the dead man's switch is the backstop, not the plan.