Reject bluegreen deploys with detached process-group machines

[tomr-a5]

Refs #4886.

What

Reject bluegreen deploys when the selected deploy target has no managed Fly
Launch Machines, but does have active detached Machines in the same process
group.

Why

Bluegreen deploys can create or update a managed Fly Launch fleet while active
Machines outside Fly Launch management keep serving old traffic. In that shape,
flyctl cannot safely cordon or replace those detached Machines as part of the
bluegreen handoff.

How

• Reuse the existing deploy filters so region-, machine-, and process-group-scoped deploys only consider detached Machines in the selected target.
• Fail before release creation in the zero-managed-target case, with an error that lists the detached Machine IDs and the metadata needed for Fly Launch management.
• Treat detached Machines with no process-group metadata as the app's default process group for this safety check.

Testing

• go test ./internal/command/deploy -run 'TestSetMachinesForDeployment|Test_resolveUpdatedMachineConfig_Basic' -count=1 -v
• go test ./internal/command/deploy -count=1
• go test -tags=integration ./test/preflight -list 'TestFlyDeployBluegreenImplicitAppProcessGroup'
• go test -tags=integration ./test/preflight -run TestFlyDeployBluegreenImplicitAppProcessGroup -count=0
• make preflight-test T=TestFlyDeployBluegreenImplicitAppProcessGroup
• git diff --check

[Copilot]

Pull request overview

This PR adds a safety gate to fly deploy --strategy bluegreen to prevent deployments when the selected deployment target has zero managed (Fly Launch) Machines but does have active detached Machines in the same configured process group(s), which could otherwise keep serving old traffic during the blue/green handoff.

Changes:

• Reuses existing deploy-target filters (regions/machines/process-groups) to scope the detached-machine safety check to the same target the deploy will act on.
• Fails early (before release creation) for bluegreen when the target has no managed Machines but has active detached Machines in configured process groups, treating missing process-group metadata as the app’s default group.
• Adds unit and integration test coverage for the new bluegreen rejection behavior (including implicit app process group cases).

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
internal/command/deploy/machines.go	Adds bluegreen validation to detect and reject detached Machines in the selected target when there are no managed Machines to safely orchestrate.
internal/command/deploy/machines_test.go	Adds focused unit tests covering reject/allow cases and filter interactions for the new bluegreen behavior.
test/preflight/fly_deploy_bluegreen_test.go	Adds an integration preflight test reproducing the implicit app process-group scenario with a detached Machine and asserting bluegreen deploy fails with actionable messaging.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.