ops: version the Dev M5 governed cutover tooling (build-ready, m5-cutover, sidecar) under scripts/ops/ #473

Problem

The only working route for a governed Dev M5 cutover (build-ready evidence built on the host → exact capability digest → operator contract → carrier pairing/approve → resumable sidecar → verify → release lease → revoke carrier) lives solely in ~/.local/bin on the M5 host: devspace-build-ready.sh, m5-cutover.sh, m5-cutover-sidecar.mjs. They are not in git, the scratchpad copies were lost, and they hard-code /Users/james paths. A host reinstall or a second governed host would have to reverse-engineer the procedure from memory.

Expected

• Add scripts/ops/m5-cutover/ with the three scripts plus a README.md describing the procedure, prerequisites (~/.devspace/config.json keys, mcpCutoverBuildReadyRoot, launchd label), resume semantics (full / resume_drain / resume_restart / resume_finish), DRAIN_WAIT_MS, the carrier recover … --confirm <carrier-id> pitfall and the release-terminal-lease workaround (until the lease fix lands).
• No hard-coded user home: derive from $HOME or env (DEVSPACE_SERVICE_ROOT, DEVSPACE_STATE_DIR, DEVSPACE_BUILD_READY_ROOT) with the current M5 values as defaults.
• bash -n / node --check clean; a small test that exercises argument parsing and the state→mode selection of the sidecar without a live host (scripts/ops/m5-cutover/*.test.mjs, same style as scripts/ops/wave3-329-direct-canary.test.mjs).
• Scripts never activate or restart anything on their own beyond the documented governed steps; no poller.

Acceptance

• Files present and documented; node --test scripts/ops/m5-cutover/*.test.mjs green; npm run typecheck / npm run build unaffected.
• Behavior identical to the copies installed on M5 on 2026-10-09 apart from path parameterization.

Note: #471 may later retire the carrier path for new cutovers; these scripts remain the historical/bound recovery tooling until that lands.

Refs #462, #464, #471