feat(ops): SNAPSHOT_CHANNEL with push-style beta rollout

Self-hosted instances can now track the beta channel:
SNAPSHOT_CHANNEL=stable|beta in ops/.env (validated at load; default
stable). pull-snapshot's skip-detection, deploy's auto-detect, and the
setup invocation all resolve through one policy implementation — the
same src/commands/setup/helpers.js fetchLatestRelease that powers
`setup --beta` (first ops→src import; ops already executes cli.js from
the same checkout). Local provenance for the gating comes from
snapshot_meta.build_macos, read readonly off the live DB; on the beta
channel the installer runs `setup --beta --force`.

publish-beta-snapshot.mjs gains --rollout <ssh-host> (default
$APPLE_DOCS_BETA_ROLLOUT): after the prerelease uploads it fires the
instance's pull-snapshot detached over ssh, so publishing from a dev
machine push-updates the instance; the weekly autoroll stays as the
channel-aware fallback.