docs(operations): document the RD deployment branch and its upstream freeze

[mrivas00]

Why

rd/integration is a long-lived branch that never merges back into Huella Latam, and nothing in the repository says so. Anyone who finds it — including whoever maintains it after this stack lands — needs to know that a routine rebase onto main is the wrong move, and why.

Docs-only · base feat/mati/rd-activity-catalog (PR 6).

What

docs/operations/rd-deployment-branch.md, linked from the operations index:

• what the branch carries (country identity, the national activity catalog, Ley 187-17 tiers, the territorial hierarchy of Ley 345-22, Dominican terminology and factors) and why it is edited in place rather than parameterized per country;
• the upstream policy: only security fixes are cherry-picked, no periodic rebase, no scheduled merge from main — upstream edits to tools/seed/src/data/base/*.json conflict with the Dominican catalogs indefinitely, so a routine rebase means re-resolving the whole catalog every sync with a real risk of silently reintroducing demo data into a national registry;
• reseeding is destructive: seed.ts skips when country.count() > 0, so replacing a catalog needs pnpm db:reset and loses every inventory captured against the previous one. Coordinate the window with MMARN.
• what should go the other way: open dumps, cable cars, isolated grids and ride-hailing describe most of the region and are worth upstreaming as a separate change against main.

Review notes

This is task 10.3 of the change. Splitting it out of PR 6 keeps that PR's diff to the catalog.

The one thing worth a second opinion is the escalation path for non-security upstream work (item 2 in the policy): cherry-pick deliberately, with an owner, keeping the Dominican side of every conflicting file. If the intended process differs — say, a quarterly review of main instead of purely on-demand — that paragraph is the place to correct it.

Verification

pnpm format clean. No code touched.