fix: fail closed backend capabilities and isolate gate smoke

tests/release-safety.test.ts

@@ -3,6 +3,7 @@ import { readFileSync } from 'node:fs';
 import {
   BASELINE_RELEASE_CAPABILITIES,
   capabilityEnabled,
+  parseBackendCapabilityAllowlist,
   parseCapabilityAllowlist,
   releaseIdIsImmutable,
 } from '../src/lib/server/release-gate';
@@ -23,6 +24,8 @@ describe('deployment rollout gate', () => {
     expect(parseCapabilityAllowlist('')).toEqual([]);
     expect(() => parseCapabilityAllowlist('asset_search,typo')).toThrow('Unknown deployment capability');
     expect(() => parseCapabilityAllowlist('asset_search,')).toThrow('Unknown deployment capability');
+    expect(parseBackendCapabilityAllowlist('asset_sync')).toEqual(['asset_sync']);
+    expect(() => parseBackendCapabilityAllowlist(undefined)).toThrow('required in the backend deployment');
   });
 
   test('requires a non-placeholder production release identifier', () => {