Restore independent push gateway deployment (#19225)

* Restore isolated push gateway deployment workflow

* Register push deployment in the shared SQL lease census

* Restore push workflow inventory and identity contracts

cloud/dev/scripts/cloud-sql-rollout-lock-census.mjs

@@ -283,6 +283,8 @@ export const LEASED_WORKFLOWS = named([
     'operate-relay-production-rehome.yml',
     production({ leaseFiles: ['operate-relay-production-rehome-job.yml'] })
   ],
+  // The gateway applies its schema at startup, so its deploy revision is the schema step.
+  ['push-deploy.yml', production()],
   ['deploy-relay-asia-topology.yml', eitherEnvironment()],
   ['operate-relay-asia-admission.yml', eitherEnvironment()],
   ['deploy-relay-staging.yml', staging()],

cloud/dev/scripts/relay-production-identity-boundaries.test.mjs

@@ -32,7 +32,8 @@ test('no workflow names the retired generic production deploy identity', async (
     'deploy-relay-production.yml',
     'operate-relay-asia-admission.yml',
     'operate-relay-production-rehome-job.yml',
-    'publish-relay-production.yml'
+    'publish-relay-production.yml',
+    'push-deploy.yml'
   ].map((name) => relayWorkflowFile(name)).sort())
 })
 

cloud/dev/scripts/relay-public-workflow-contract.test.mjs

@@ -20,7 +20,7 @@ const UNGATED = relayWorkflowFile('verify.yml')
 const relayWorkflows = () => workflowFiles().filter((file) => file !== UNGATED)
 
 test('the copy carries every relay workflow', () => {
-  assert.equal(relayWorkflows().length, 24)
+  assert.equal(relayWorkflows().length, 25)
 })
 
 // Why: workflow_run chains match by display name, not filename. Renaming a file is safe; renaming