feat(ci): deploy only the variants a change reaches

An image bump in a provider redeployed every variant of every consumer,
including the variants that switch that provider off and therefore never
deploy the bumped image at all. The diff-derived whitelist now narrows each
affected role to the variants whose own round closure still reaches a seed,
emitted as `role#0,2` selection tokens. That closure is walked on the same
variant-merged services maps the matrix planner builds its rounds from, so the
narrowing follows a parent's variant choice across every generation of the
chain. It covers every auto-derived whitelist: the weekly update PRs,
Dependabot, and any other diff-driven run.

The narrowing never shrinks the matrix on partial information. A seed role
keeps every variant, because its own files changed. A role reached only
through a run_after edge keeps every variant too, because the round closure
does not follow that edge and a role whose hits are empty is therefore
unnarrowed rather than dropped.

A pinned token naming a role the discovery query does not return now warns
instead of aborting the run. The diff-derived whitelist legitimately names
roles the lifecycle envelope filters out, and once it pins variants such a
token would abort every chunk; role names are still checked against roles/
before the run starts, so a typo is caught one layer earlier.

The round's variant merge moves out of the deploy inventory package into
utils/roles/applications/variants.py. The CI selection has to build the same
maps, and importing the deploy package for them pulls in a module that reads
INFINITO_SRC_DIR at import time, which the runner host does not set.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

tests/unit/python/utils/github/variant/test_selection.py

@@ -199,6 +199,11 @@ class TestApply(unittest.TestCase):
     def test_a_bare_role_that_matches_nothing_is_tolerated(self) -> None:
         self.assertEqual(selection.apply(_ROWS, selection.parse_list("web-app-c")), [])
 
+    def test_a_pin_on_an_undiscovered_role_is_tolerated_like_a_bare_one(self) -> None:
+        self.assertEqual(
+            selection.apply(_ROWS, selection.parse_list("web-app-c#0,2")), []
+        )
+
 
 if __name__ == "__main__":
     unittest.main()