Add GraphQL subscriptions for CD rollout and application health

What does this MR do and why?

Adds two GraphQL subscriptions so the frontend can receive live rollout/application state changes instead of polling:

• cdRolloutUpdated — pushed when a rollout or one of its rollout environments changes state (stage/step start, complete, fail).
• cdApplicationHealthUpdated — pushed when an application's health rolls up differently as a result of a deployment outcome.

This is substrate work: it adds the subscription types, payload/enum types, and GraphqlTriggers methods that later work (deployment state roll-up, workflow event ingestion) will call. No application code calls these triggers yet — see out-of-scope below.

Both subscriptions authorize read_cd_application, resolved from the GID argument (not self.object, since the triggered payload envelope is not the application itself).

References

Resolves https://gitlab.com/gitlab-org/gitlab/-/work_items/607017

Extracted from the cd-summit-demo-2026 R&D summit demo branch (!246676 (closed)).

Example queries

cdRolloutUpdated

subscription {
  cdRolloutUpdated(applicationId: "gid://gitlab/Cd::Application/1") {
    reason
    rollout {
      id
      state
    }
    rolloutEnvironment {
      id
      state
    }
    thread {
      id
      title
    }
  }
}

cdApplicationHealthUpdated

subscription {
  cdApplicationHealthUpdated(organizationId: "gid://gitlab/Organizations::Organization/1") {
    id
    name
    health
  }
}

How to set up and validate locally

1. In a Rails console, subscribe via GraphiQL to one of the queries above.
2. Fire the trigger manually:

rollout = Cd::Rollout.first
GraphqlTriggers.cd_rollout_updated(rollout, :deployment_failed)

3. Confirm the subscriber receives the payload.