Stop printing PASS when deployment-safety checks only warn

[jmjava]

Summary

• Leftover Fail closed when scripted orchestrator apply triples mismatch #20: check_deployment_safety.py printed PASS deployment safety (warnings) for warnings-only runs, so a hostile private-LAN config still looked like success.
• The summary banner is now WARN deployment safety when worst_status is warn. Clean pass still prints PASS; fail still prints FAIL and exits 1. Warnings-only still exits 0 so CI --skip-listen stays green.
• Proving test: test_warnings_only_does_not_print_pass (private LAN http://192.168.1.10:11434) plus test_skip_listen_exits_0_on_current_repo now assert the output does not contain PASS deployment safety.

Leftover #5 MAX_BYTES, leftovers #18/#19 live rates, downstairs GPU, and Halo 4 were not touched.

Test plan

• PYTHONPATH=src python3 -m unittest tests.test_deployment_safety_ci tests.test_safety -v
• PYTHONPATH=src python3 scripts/check_deployment_safety.py --skip-listen prints WARN deployment safety and exits 0
• GitHub Actions unit job green, including Deployment safety

Made with Cursor