[Chore] Validate deployment artifacts in CI

[mrubens]

What changed

• build both app and worker images in pull-request CI
• validate every maintained Compose shape plus Railway, Render, Coolify, and Fly against a shared deployment catalog
• add production controller and BullMQ health checks
• gate image publishing on a production deployment lifecycle: generated secrets, migrations, setup/health probes, Docker-backed task launch, prior-channel upgrade, rollback, backup, and fresh-volume restore
• retain native amd64 and arm64 release builds
• pin critical infrastructure images and external GitHub Actions to immutable digests/commit SHAs

Why

Deployment artifacts were not first-class CI inputs, so docker compose up --wait could succeed while the execution plane was unhealthy and release-only deployment paths could drift unnoticed.

Validation

• pnpm deployment:validate
• pnpm --filter @roomote/cloud-agents check-types
• pnpm --filter @roomote/cloud-agents lint
• pnpm knip
• pre-push pnpm lint:fast, pnpm check-types:fast, and pnpm knip
• production app and worker image builds on linux/arm64
• prior develop image → candidate migration → rollback → candidate
• Docker-backed task launch through the production controller
• backup restored onto fresh Compose volumes with all services healthy

Compatibility note

v0.0.1 predates the current rewritten Drizzle migration baseline and cannot be used as a direct migration predecessor. For the first gated tagged release, CI tests the prior published main candidate. Subsequent tagged releases use the immediately preceding immutable release tag.

[roomote-roomote]

Re-checked after the latest push. The only new PR-scoped change since the last review is the Fly deployment validation simplification: it collapses the redundant if/else in the fly.toml process loop down to a single assert, which resolves the earlier review nit. deploy/fly/fly.toml still declares all four runtime processes (web, api, controller, bullmq) matching the catalog commands, so the check is behavior-preserving. Everything else in range is base-branch code pulled in by the rebase. No new code issues found. See task

• deploy/ci/validate-deployment-artifacts.mjs:196-208 — the fly.toml process loop has an if (name === 'api' || name === 'web') { ... } else { ... } where both branches assert the identical condition (fly.processes?.[name] === contract.command), differing only in the error string. The special-casing is dead logic; collapse it to a single assert for every runtime service.

[mrubens]

Addressed the review nit in 30a9a95: the Fly process validation now uses one shared assertion for every runtime service. Re-ran pnpm deployment:validate; pre-push lint, fast type checks, and Knip also pass.