ci-workflows

Shared deploy step (deploy.sh) for every app we build from our own code (WP-53). Each app CI runs it after tests pass on main; see the header of deploy.sh.

Secrets (user-level Actions secrets)

• REGISTRY_TOKEN: registry push token (package read/write).
• INFRA_DEPLOY_KEY: SSH private key; its public half is a write-enabled deploy key on the infra repo.
• INFRA_REPO_URL: SSH URL of the infra repo, e.g. ssh://git@<host>:<port>/<owner>/<repo>.git.
• INFRA_KNOWN_HOSTS: the SSH host-key line(s) for that host, e.g. from ssh-keyscan -p <port> <host>.
• NTFY_TOKEN (optional): ntfy publish token for failure alerts.