feat(ci): add staging deployment workflow

[zhangc110033]

Summary

• add a manual selected-ref Staging deployment workflow
• build immutable API/Worker images tagged with the selected commit SHA
• keep services at zero while running prisma migrate deploy as a one-off ECS task
• activate API/Worker only after migration succeeds
• verify ECS stability and the ALB readiness endpoint

Safety

• workflow can only run from main
• selected refs cannot change infra/terraform
• Terraform guards permit only Staging task definition/service release changes
• non-task-definition destroys are rejected
• the AWS role is limited to Staging state, ECR, ECS services, migration task, and task roles
• Production state/ECR/ECS writes are denied by IAM simulation

Validation

• workflow YAML parsed
• all shell blocks pass bash -n
• Prettier passes
• Terraform validate passes
• real Staging prepare plan: 0 add / 0 change / 0 destroy
• real Staging activation plan: 0 add / 2 change / 0 destroy (API/Worker services only)

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 04b1f5be96

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Wait for services to drain before migrating

When staging currently has running API/worker tasks, this apply only submits the desired_count=0 service updates and then the next step starts the migration immediately. I checked infra/terraform/ecs_services.tf, and neither ECS service sets wait_for_steady_state; the AWS provider docs say that option defaults to false, so old tasks can still be draining and writing to the database while pnpm migrate is running. Add an explicit aws ecs wait services-stable after the prepare apply, or otherwise make Terraform wait for the zero-count state before launching the migration task.

Useful? React with 👍 / 👎.