Defer deployment-layer sync while tenant runtime is suspended

[Tallen231210]

Summary

• treat the exact suspended-tenant response as temporarily unavailable during deployment-layer sync
• defer only when unavailable deployments are explicitly allowed
• keep other HTTP 503 failures strict

Verification

• node --test cli/test/deployment-layer.test.ts
• npm run typecheck

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}