chore(ops): carry FLOWSHEET_TAKEOVER_ENABLED through the env-var allowlist

[jakebromberg]

Closes #2388.

FLOWSHEET_TAKEOVER_ENABLED has shipped dormant since BS#2233 and cannot be turned on through any supported path: set-ec2-env-var.yml's resolve step hard-fails with Unsupported secret_name on any key absent from its env block, and this one was never added — it appears in test.yml and dev_env/docker-compose.yml only. Production has therefore run the pre-BS#2233 silent co-host attachment continuously, most recently absorbing five DJs into show 1951317 over 14.5 hours while djs-on-air named four of them at once. #2388 has the full trace.

This adds the key to the env block and the resolve case, matching STATION_SIGNUP_ENABLED, and records the operational contract in docs/env-vars.md.

Two things the comment makes explicit, both easy to get wrong:

• Lowercase true, and rollback is false — never empty. The reader is a strict === 'true' comparison through createEnvFlagConfig, so TRUE reads as false and cannot use the uppercase log-safety workaround ENRICHMENT_SUPPRESS_LML_BUDGET uses. Expect ::add-mask:: to redact the word "true" elsewhere in the run's logs. Clearing the value instead of setting false hard-fails the resolve step.
• restart_target=backend is required, not incidental. Unlike the cron-invoked STATION_SIGNUP_* keys — which docker run --env-file .env re-reads every run, making their restart pure collateral — the backend is a long-running container that reads its env at boot.

No behavior change lands with this PR. The workflow is only dispatchable manually, and the flip is a separate ops step: set the repo secret, then dispatch with key=FLOWSHEET_TAKEOVER_ENABLED restart_target=backend.

Rollout preconditions (verified 2026-09-08)

BS#2233's note requires every 409-aware client to ship before the flip. dj-site's handoff prompt (readShowAlreadyOpen / useGoLiveHandoff) is on main and deployed, and already renders today off the djs-on-air poll — the flip is what makes its "End Existing Show" button do what it says. auto-dj-orchestrator became 409-aware on 2026-08-30 (4e15cb67, b33f2d5f) and is not deployed regardless: no deploy workflow, and no NEXT_PUBLIC_ORCHESTRATOR_URL in dj-site production.

Testing

• npm run check:doc-rules and npm run check:doc-budget pass; the remaining warnings are pre-existing on main.
• Workflow YAML parses and the new key resolves in the env block; the case arm is present.