fix: make gateway dialog handling and rollouts fail closed

[Pigbibi]

What changed

• Leaves compact Gateway dialogs open and emits a stable GATEWAY_UI_BLOCKER signal instead of blindly acknowledging them.
• Removes push-triggered runtime deployment; CI remains the validation path.
• Makes scheduled and manual keepalive use the already released source and environment.
• Requires one explicit target for full container/source rollouts.
• Resolves account credentials only for full manual deployments.

Verification

• python3 -m py_compile 2fa_bot.py
• bash tests/test_docker_compose_ports.sh
• bash tests/test_workflow_shared_config.sh
• bash tests/test_install_2fa_bot_watcher.sh
• bash tests/test_wait_for_ib_gateway_ready.sh

No trading target was enabled or changed.