fix(deploy): set STATIC_URL for the production frontend build

[field123]

Fixes the integration outage — Unexpected fields on [CodeComponentMeta]: + subtreePrefetchingConfig when opening an existing project.

What happened

deploy-integration succeeded on 00af6c2976; deploy-frontend — which runs on workflow_run after it — failed (run 31478165556):

error   process.env.STATIC_URL missing in production build
    at tools/webpack/mkDefinePluginOptsForEnv.ts:49
    at rsbuild.config.ts:245

STATIC_URL arrived with the upstream merge (it has zero hits in the pre-merge mkDefinePluginOptsForEnv.ts) and is declared OPTIONAL_VAR at rsbuild.config.ts:248. OPTIONAL_VAR is fatal when NODE_ENV=production, so the build died before emitting anything and the S3 bundle was never replaced.

Why that produced the error

The two halves of the deploy diverged:

• Server (new): reads a project, runs migration 258-add-code-component-subtree-prefetching-config, writes subtreePrefetchingConfig onto every CodeComponentMeta.
• Studio client (stale, pre-merge): its compiled classes-metas has no such field.

model-meta.ts:288-295 prefixes + for a key present on the instance but absent from the meta — precisely this direction. So it's a client/server skew, not corrupt data and not a bad migration.

The fix

NODE_ENV=production PUBLIC_URL=${FRONTEND_URL} STATIC_URL=${FRONTEND_URL} yarn build

getStaticUrl() is process.env.STATIC_URL || getPublicUrl() (shared/urls.ts:63), so FRONTEND_URL reproduces pre-merge behaviour exactly. Deliberately not HOST_URL — upstream #3049 (DEVOP-445) moves static/canvas content to a dedicated subdomain, and repointing where Studio fetches static assets is a behaviour change that shouldn't ride along with an incident fix. Worth doing deliberately afterwards.

After merging

Dispatch deploy-frontend.yml with environment=integration, then confirm an existing project opens. No data repair needed — the bundles are correct; only the client was behind.

Follow-ups

• Prod promotion must not go out until this has landed, or prod gets the same skew.
• deploy-frontend failing leaves a silently half-deployed system: the server moves, the client doesn't, and nothing blocks or alerts. Worth making a frontend-deploy failure a hard gate.