feat(phase-6c): CI/CD deploy pipeline and security review

[Mahakisore7]

Summary

• .github/workflows/deploy.yml: build/push 3 images to Artifact Registry → terraform apply staging → smoke-test /healthz → GitHub Environments manual-approval gate → terraform apply production. Authenticates via Workload Identity Federation (infra/terraform/wif.tf), not a long-lived JSON key.
• Extends ci.yml with a credential-free terraform fmt/validate job (every PR) and a WIF-gated terraform plan job (push to main only — skips cleanly with a warning until the two required repo secrets exist, rather than failing red).
• Completes the Phase 6 security review checklist with real evidence per item (docs/Phases/PHASE-06-SECURITY-REVIEW.md), not checked off from memory.

Live verification

• A real terraform plan against the real project caught a genuine bug terraform validate alone missed: a for_each over service-account names computed its key set from apply-time-unknown values. Fixed by keying the for_each map on the three static role names instead — replan confirmed clean (72 resources, 0 errors).
• Security review: live Gemini prompt-injection spot check (passed), real captured structured-log line proving no secret values leak, all local pytest auth/ownership boundary tests passing (deployed re-verification honestly deferred — no staging applied yet).

Test plan

• YAML syntax validated (python -c "import yaml; ..."); no actionlint available in this environment, so also manually reviewed
• terraform fmt -check, terraform validate, terraform plan (documented above)
• Full deploy.yml run — can't be exercised until GCP_WORKLOAD_IDENTITY_PROVIDER/GCP_SERVICE_ACCOUNT repo secrets exist (one-time WIF apply, see infra/README.md)

Base branch note: targets feat/phase-6b-terraform-infrastructure (not main) since wif.tf extends that PR's infra/terraform/ — recommended merge order is 6a → 6b → 6c.

Part 3 of 3 for Phase 6.

🤖 Generated with Claude Code