Org Read-Only Mode: feature flag gating for cohort-by-cohort rollout
<!--IssueSummary start-->
<details>
<summary>
Everyone can contribute. [Help move this issue forward](https://handbook.gitlab.com/handbook/marketing/developer-relations/contributor-success/community-contributors-workflows/#contributor-links) while earning points, leveling up and collecting rewards.
</summary>
- [Label this issue](https://contributors.gitlab.com/manage-issue?action=label&projectId=278964&issueIid=602810)
</details>
<!--IssueSummary end-->
Part of &20404 ([Implement Organizations Read-Only Mode](https://gitlab.com/groups/gitlab-org/-/work_items/20404)). Design: [ADR 010](https://handbook.gitlab.com/handbook/engineering/architecture/design-documents/organization/decisions/010_organization_read_only_mode/).
- Environment-scoped and Organization-scoped feature flag gating so rollout can proceed cohort-by-cohort
- On GitLab.com: enable first for internal/test Organizations, then expand alongside existing Organizations rollout cohorts
- Default-off on Self-Managed and Dedicated (instance-wide Maintenance Mode remains the right tool there, see ADR 007)
issue