Use global lane for maildesk sender previews

[rogu3bear]

Summary

• Generates maildesk sender-domain component preview commands with CF_TOKEN_LANE=global.
• Keeps sender-domain readback and sender-domain preview on the same lane, avoiding default-lane zone resolution failures.
• Pins the command shape in the maildesk lifecycle contract fixture.

Test plan

• bash scripts/verify_maildesk_cf_contract.sh
• python3 -m py_compile scripts/cf_maildesk_cf_lifecycle.py
• git diff --check
• ./scripts/verify_static_contract.sh
• From /Users/star/dev/star-maildesk-cf: cfctl maildesk-cf provision --file config/desired-state.local.json --plan produced 14/14 global-lane sender-domain previews
• From /Users/star/dev/star-maildesk-cf: executed 14/14 sender-domain preview commands as --plan; all returned ok=true, performed=false, plan_mode=true, and operation ids

Risk / review focus

• Confidence: high that the failure was lane-specific; the same dry-run failed on the default lane with zone resolution and succeeded on global.
• Review focus: confirm sender-domain enable should consistently use the global lane for private maildesk zones, matching lifecycle readback.
• Production posture: this PR changes preview command generation only. It does not run --ack-plan and does not mutate Cloudflare.

[rogu3bear]

@codex Please review the sender-domain preview lane change. I am least certain whether global should be hardcoded for every maildesk sender-domain component preview, but it matches current readback and is what makes private zone dry-runs resolve.

[rogu3bear]

Local proof is green: maildesk lifecycle contract, py_compile, diff check, static contract, private composite plan, and 14/14 private sender-domain component dry-run previews. The GitHub static-contract job failed before runner steps/logs were recorded, matching the existing cfctl Actions startup-failure pattern on main.