Canary and Blue-Green Deploys for Model Changes

Traffic splitting for model versions, an eval gate as the promotion criterion, and the sample-size arithmetic that says how long a canary must run to mean anything.