fix: keep beta prebuilt auth migrations on the right database

[steve8708]

Summary

• Resolve dedicated beta database URLs before shared production database mirrors.
• Restore the documented shared-database fallback for beta sites whose Netlify secret is not exportable.
• Keep strict post-publish health, schema, and auth smoke as the gate for non-exportable targets.

Validation

• corepack pnpm test:netlify-prebuilt-workflow
• corepack pnpm guard:netlify-prebuilt-workflow
• corepack pnpm exec oxfmt --check scripts/guard-netlify-prebuilt-workflow.ts scripts/guard-netlify-prebuilt-workflow.test.ts

[github-actions]

Here's a visual recap of what changed:

Open the full interactive recap

[builder-io-integration]

Builder reviewed your changes — looks good ✅

Review Details

Incremental Code Review Summary

The latest revision addresses all three previously open comments. Beta baseline capture now occurs before the unlock, the rollback failure path throws when no deploy is available instead of suppressing the failure, and the beta failure cleanup was moved after the final cache and docs verification steps. The cleanup now covers failures across the full beta cutover sequence.

Three parallel incremental reviews found no new confirmed issues. They specifically checked baseline capture and unlock ordering, queue-drain behavior, rollback pinning, pending restore handling, and the final cleanup placement. The focused guard/test updates are consistent with the new ordering and failure paths.

Risk remains standard because this is deployment and rollback orchestration. Browser testing is not applicable because no user-facing UI changed.

🧪 Browser testing: Skipped — PR only modifies backend/config/docs, no UI impact