Add code_smoke host gate: migrate-from-scratch + seed + serve /health
gates: own the scratch cluster's privileges in code
Extract sando promotion service out of daemon routes.rs