feat(ci): deploy to prod automatically on merge to main

[cqnykamp]

Summary

Makes production deployment fully automatic: merging a PR to main now deploys to prod immediately, with no CI re-run on main and no manual approval step.

Why this is safe: branch protection requires PR branches to be up to date with main, so the tree that lands on main is content-identical to what the PR's required checks already tested. Re-running CI on main and waiting for a human click added ~30–60 minutes of latency without adding information.

Changes

• Trigger on push to main instead of workflow_run on CI completion; deploy github.sha directly.
• Remove the approve job. Nothing references the prod environment's protection rules anymore, so deploys can't be gated by them. (Follow-up for repo settings: the required-reviewer rule on the prod environment is now inert and can be removed.)
• cancel-in-progress: false. Merging PR B while PR A's ~10-minute deploy is mid-flight previously canceled A mid-S3-sync / mid-ECS-rollout — potentially killing the rollback logic itself. Now A finishes, and GitHub queues only the newest pending run (which, per branch protection, contains every earlier merge). Intermediate pending runs are superseded before they start, which is harmless.
• Record deployments on the prod GitHub Environment, mirroring dev3's pattern: open a deployment via the Deployments API, mark in_progress at start, finalize with a success/failure rollup (per-component results in the description) after backend/frontend/site complete. Bookkeeping is best-effort and no deploy job depends on it, so an API hiccup can never block or skip a deploy. On success GitHub auto-inactivates the previous record, so the Environments tab always shows what's live.
• Remove the tag-prod job. The deployment record supersedes the force-pushed prod tag (nothing in the repo reads it). The stale tag on the remote can be deleted separately: git push origin :refs/tags/prod.

Operational notes

• Deploy gate is now the PR required-checks list. Worth verifying it includes every CI job (check + all e2e-tests, e2e-brittle-tests, component-tests matrix entries) and that direct pushes to main are blocked, since any push to main now ships.
• Rollback path: revert the PR, or re-run the last good Prod Deploy workflow run (redeploys that SHA). Backend additionally keeps its existing ECS stabilization + image-retag rollback.
• CI still runs on main pushes as a signal; it no longer gates anything.

🤖 Generated with Claude Code