fix(cd): decouple executor boundary from endpoint outage

apps/api/tests/test_executor_network_policy_boundary.py

@@ -120,5 +120,7 @@ def test_cd_applies_rolls_back_and_verifies_network_boundary() -> None:
     assert workflow.count(expected_hosts) >= 4
     assert "except ConnectionRefusedError:" in workflow
     assert "broker_ssh_refused_but_egress_permitted=" in workflow
-    assert "connected and len(permitted) == len(sys.argv) - 1" in workflow
+    assert "broker_ssh_allowlisted_endpoint_unavailable=" in workflow
+    assert "raise SystemExit(0 if connected else 1)" in workflow
+    assert "len(permitted) == len(sys.argv) - 1" not in workflow
     assert "ssh-mcp-key known_hosts 更新失敗，停止部署" in workflow