Document the worker-function enable fence for production deployments

[jumski]

Scope

Fix the current one-function-per-flow production update guide.

Document one copyable safety sequence that disables the existing pgflow.worker_functions row, deprecates and drains its workers, deploys the replacement while disabled, restores the previous enabled state, and checks live heartbeats.

Private per-step, alias-version, and shared-queue rollout documentation belongs to #651, #648, and #652 respectively. Those future APIs do not block this P1 documentation fix.

Problem

The production Update Deployed Flows guide currently says to:

1. deprecate old workers;
2. deploy the new function;
3. wait for cron to start it.

It does not disable the corresponding pgflow.worker_functions row before deprecation. While that row remains enabled, ensure_workers() may start another instance of the old deployed function between deprecation and deployment.

Required sequence

For one existing worker function:

1. Read and record its current enabled value.
2. Set enabled = false.
3. Deprecate its live worker rows.
4. Wait until every affected worker stops polling and finishes in-flight callbacks.
5. Deploy the replacement while the function row remains disabled.
6. Restore the recorded enabled value.
7. Confirm the expected worker starts and reports a current heartbeat when re-enabled.

Do not infer the final state after deployment. Restore the exact state recorded before the fence.

Copyable checks

The guide must provide copyable SQL for:

• recording the current enabled state;
• disabling the function;
• deprecating its live workers;
• checking that polling and callbacks have stopped;
• restoring the recorded state;
• checking the replacement worker and heartbeat.

State what operators should inspect when the drain or restart does not complete. Do not add deployment automation or another activation protocol.

Documentation placement

Update the current production guide and link to it from the existing worker-management documentation.

Future features own their additional rollout instructions:

#651  complete affected per-step worker set and new concrete-version drain
#648  alias activation and rollback after new queue coverage
#652  shared-worker registry replacement and version drain

Acceptance criteria

• The production guide disables the existing worker-function row before deprecating workers.
• The guide records and restores the exact previous enabled state.
• The replacement deploys while automatic restart remains disabled.
• Copyable SQL checks that old workers stopped polling and finished callbacks.
• Copyable SQL checks the replacement worker and current heartbeat after restoration.
• Failure guidance covers a worker that does not drain or restart.
• Existing worker-management documentation links to the corrected sequence.
• Future per-step, alias, and shared-queue rollout requirements remain with Add private per-step queues with typed step workers #651, Add stable flow aliases through DeployedFlow startup deployment #648, and Add explicit shared queues with multi-flow dispatch #652.

Out of scope

• Private per-step deployment manifests.
• New concrete-version rollout and drain.
• Alias activation or rollback.
• Shared-worker registry deployment.
• Cross-worker activation transactions.
• Automatic deployment orchestration.
• Automatic old-version removal.