Resolves #13989

Enables the orchestrator deployment-state bridge writer by default while preserving the explicit NEO_DEPLOYMENT_STATE_BRIDGE_ENABLED=false opt-out. This keeps KB/MC as read-only public consumers of the bounded snapshot and removes the hidden extra setup step that left #13936 stuck at snapshot-missing.

Evidence: L2 unit/static passed -> L3 required by #13936 after merge/restart because the smoke needs a live orchestrator snapshot through KB/MC public tools.

Deltas from ticket

No public privileged route was added. The change is limited to the AiConfig default/comment, the canonical default fixture, and the config-template spec.

ai/config.mjs was updated locally by the overlay migration context while investigating, but it is ignored and intentionally not part of this PR.

Test Evidence

• node --check ai/config.template.mjs
• node --check ai/config.mjs
• node --check test/playwright/unit/ai/config.template.spec.mjs
• npm run test-unit -- test/playwright/unit/ai/config.template.spec.mjs test/playwright/unit/ai/daemons/orchestrator/services/DeploymentStateBridgeService.spec.mjs -> 12 passed.
• node ai/scripts/lint/lint-config-template-ssot.mjs -> OK.
• npm run agent-preflight -- ai/config.template.mjs test/playwright/fixtures/aiConfigDefaults.mjs test/playwright/unit/ai/config.template.spec.mjs -> passed.
• git diff --check and git diff --cached --check -> clean.

Post-Merge Validation

• Pull dev, run node ./ai/scripts/setup/initServerConfigs.mjs --migrate-config, then restart orchestrator and harness.
• Verify the orchestrator writes .neo-ai-data/deployment-state/snapshot.json without setting NEO_DEPLOYMENT_STATE_BRIDGE_ENABLED=true.
• Verify KB and MC inspect_deployment(staleAfterMs: 600000) no longer return snapshot-missing once the orchestrator has polled.
• Re-run #13936 KB/MC-only smoke with no private shell, Docker socket, privileged route, or graph-only proof.

Commits

• 7ca4d63b3e - fix(ai): enable deployment-state bridge by default (#13989)

Related: #13936, #13986.

Authored by Euclid (GPT-5, Codex Desktop). Session 1c4b42c3-289a-4196-bec0-36a3a9f16fa6.

Combined preflight with #13986

I validated this PR on top of #13986 in a disposable worktree, since #13986 is the required first merge/deploy gate.

Evidence:

• Created temp worktree from #13986 head and merged this PR cleanly.
• Ran node ./ai/scripts/setup/initServerConfigs.mjs --migrate-config in that temp worktree.
• Ran focused combined suite:

npm run test-unit -- test/playwright/unit/ai/config.template.spec.mjs test/playwright/unit/ai/provider/KeepAlive.spec.mjs test/playwright/unit/ai/services/graph/SemanticGraphExtractor.spec.mjs test/playwright/unit/ai/services/memory-core/helpers/remRunStateStore.spec.mjs test/playwright/unit/ai/services/rem-observability.spec.mjs test/playwright/unit/ai/daemons/orchestrator/services/DeploymentStateBridgeService.spec.mjs

Result: 88 passed, 1 skipped.

Temp worktree was removed after validation.