feat(rollback): show a plan-not-available message when instant rollback isn't entitled

[AryanBansal-launch]

What

launch rollback shows a distinct message when an org's plan doesn't include instant rollback, instead of the same generic "no eligible deployments" message used for a genuinely-empty environment.

Why

Today, if getEligibleSortedDeployments() comes back empty, the CLI always prints:

No rollback-eligible deployments are available for this environment.

...regardless of the actual reason — an org whose plan simply doesn't include instant rollback sees the exact same message as an environment that just hasn't archived anything yet. There's no way for a user to tell "you're not entitled to this" apart from "there's nothing to roll back to yet."

The Launch UI recently shipped an equivalent fix (org entitlement now drives a distinct "not available on your plan" state instead of the previous ambiguous empty state), backed by a new RollbackSettings { isEnabled, retentionCount } GraphQL query in contentfly-management-service. This PR gives the CLI the same clarity by querying that same signal.

How

• New rollbackSettingsQuery (src/graphql/queries.ts).
• New fetchRollbackSettings() on Rollback (src/commands/launch/rollback.ts) — fails open (.catch(() => undefined)) on any fetch error, mirroring the existing fetchCurrentLiveDeployment pattern in the same file.
• Only fires on the already-failing path (isEmpty(eligibleSorted)) — no extra network call when a rollback target actually exists.
• Shows "Instant rollback isn't available on your organization's plan." only when the backend explicitly says isEnabled: false; falls back to the existing generic message in every other case (org is entitled, settings fetch fails, or the field is simply absent).

Explicitly out of scope

This does not change the rollback mutation's own authorization. rollbackDeployment is still gated solely by a deployment's isRollbackEligible flag — there is no live entitlement check on the mutation itself (same gap the UI has). This PR is a message-clarity improvement only; closing that gap would be a separate, backend-side change (it would need to land in contentfly-management-service and would benefit both the UI and this CLI simultaneously, since they share the same mutation).

Test plan

• New jest cases: shows the plan-not-available message when isEnabled: false; falls back to the generic message when the settings fetch fails; existing "no eligible deployments" case updated to keep passing (isEnabled: true)
• npm run test:jest -- src/commands/launch/rollback.test.ts — 7/7 passing
• npx eslint on all three changed files — clean
• npx tsc --noEmit — clean
• Full npm run test (mocha + jest + integration) — 8+6 suites, 139+31 tests, all passing
• Secrets scan (Talisman + trufflehog) — clean

#claude_code#
🤖 Generated with Claude Code

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[github-actions]

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Count (with fixes)	Without fixes	Threshold	Result
🔴 Critical Severity	0	0	10	✅ Passed
🟠 High Severity	0	21	25	✅ Passed
🟡 Medium Severity	0	12	500	✅ Passed
🔵 Low Severity	0	0	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	Breaches (with fixes)	Breaches (no fixes)	SLA Threshold (with/no fixes)	Status
🔴 Critical	0	0	15 / 30 days	✅ Passed
🟠 High	0	0	30 / 120 days	✅ Passed
🟡 Medium	0	0	90 / 365 days	✅ Passed
🔵 Low	0	0	180 / 365 days	✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

• Critical without fixes: 0
• High without fixes: 21
• Medium without fixes: 12
• Low without fixes: 0

✅ BUILD PASSED - All security checks passed

[github-actions]

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Count (with fixes)	Without fixes	Threshold	Result
🔴 Critical Severity	0	0	10	✅ Passed
🟠 High Severity	0	21	25	✅ Passed
🟡 Medium Severity	0	12	500	✅ Passed
🔵 Low Severity	0	0	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	Breaches (with fixes)	Breaches (no fixes)	SLA Threshold (with/no fixes)	Status
🔴 Critical	0	0	15 / 30 days	✅ Passed
🟠 High	0	0	30 / 120 days	✅ Passed
🟡 Medium	0	0	90 / 365 days	✅ Passed
🔵 Low	0	0	180 / 365 days	✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

• Critical without fixes: 0
• High without fixes: 21
• Medium without fixes: 12
• Low without fixes: 0

✅ BUILD PASSED - All security checks passed