Track earliest allowed rollback point

[bfops]

Summary

• track the earliest allowed rollback point in the repository
• compute it from the previous release's tracked value and rollback-safety requirements on new PRs
• have PR CI commit a corrected value when needed
• validate the committed value at the release gate without mutating release tags
• include the validated rollback point in release Docker images

Testing

• cargo test --offline --package rollback-coordination
• cargo check --offline --locked --package ci-rollback-file
• cargo ci other-workflows rollback-file --check --pr-number 5986
• Git tree checks, including rollback-file generation

Rollback safety impact

n/a