ARO deployment workflow and release profile

[tuxerrante]

Why

We need a repeatable, automated path to deploy on ARO from GitHub Actions with minimal manual steps.

Current state

• P0: AI runtime & credentials strategy for cluster deployment #4 (AI runtime strategy) is complete — Vertex and Azure OpenAI providers are implemented with readiness checks, mock mode, and startup validation.
• Build-push workflow exists: .github/workflows/build-push.yml builds and pushes frontend/backend images to GHCR on push to main.
• Helm chart is functional: Deployed on ARO with ConfigMap for AI env vars, PVC for data, Route for ingress, health/readiness probes.
• Makefile has operational targets: e2e-azure-route (OpenShift deploy + probe) and smoke-local-vertex exist but are manual.
• No automated deploy-to-ARO workflow exists in CI.

Proposed scope

1. CI/CD workflow: Add a GitHub Actions workflow that deploys the chart to a test namespace on ARO after image push.
2. ARO values profile: Formalize the ARO-specific values file (currently example files exist).
3. Post-deploy verification: Run health/readiness checks and optionally helm test (Integration test pipeline (API + helm test) #7) after deployment.
4. Rollback strategy: Document or automate rollback on failed deploy.
5. Tag-based releases: Deploy to production namespace on tag push (vs test namespace on main push).

Acceptance criteria

• One workflow deploys the stack to a test ARO namespace on push to main.
• Workflow captures image tags and chart version used in deployment.
• Post-deploy checks verify frontend, backend, and AI readiness.
• Tag-based production release path is documented or automated.

Dependencies

• Complements Helm portability baseline (OpenShift + generic Kubernetes) #5 (Helm portability) and Integration test pipeline (API + helm test) #7 (integration tests).
• Benefits from WIP - terraform infra #12 (Terraform) for infrastructure provisioning, but can work with manually provisioned clusters.