[codex] fix CI Railway health probes for deployment drift checks

[msaad00]

Summary

• normalize Railway MCP URLs so CI health checks work whether RAILWAY_MCP_URL is configured as the bare host or the /mcp endpoint
• reuse one deployment probe helper across the deployment-freshness and deploy-mcp-sse workflows
• avoid opening or auto-closing supply-chain drift issues when the probe itself is temporarily unavailable
• add regression tests for workflow wiring and health URL normalization/retry behavior

Root Cause

The deployment drift workflow and the post-deploy verification step assumed RAILWAY_MCP_URL always pointed at the health base URL. Elsewhere in the repo, Railway MCP URLs are also represented as the /mcp endpoint for registry publishing. That mismatch could make CI probe the wrong path and fall back to unknown, creating false-positive drift alerts like #1281 even when Railway was serving the expected version.

Validation

• pytest -q tests/test_deployment.py tests/test_deployment_probe.py
• ruff check src/agent_bom/deployment_probe.py tests/test_deployment.py tests/test_deployment_probe.py
• PYTHONPATH=src python3 -m agent_bom.deployment_probe --base-url https://agent-bom-mcp.up.railway.app/mcp --attempts 2 --backoff-seconds 1 --timeout 15

Impact

CI now resolves the canonical /health endpoint consistently, retries transient failures, and only flags actual deployment drift instead of URL-shape mismatches.