fix: isolate staging deployment control

Make staging migration, deployment, and maintenance workflows use the staging branch exclusively so test delivery no longer depends on or modifies production main.

.github/workflows/configure-staging-rectification-rollout.yml

@@ -47,10 +47,10 @@ jobs:
       SYNTHETIC_SMOKE_USER_IDS: ${{ inputs.synthetic_smoke_user_ids }}
 
     steps:
-      - name: Checkout trusted controller
+      - name: Checkout staging controller
         uses: actions/checkout@v4
         with:
-          ref: main
+          ref: staging
           persist-credentials: false
 
       - name: Validate rollout request and staging target

.github/workflows/deploy-staging.yml

@@ -111,10 +111,10 @@ jobs:
             echo "allow_rollback=$allow_rollback"
           } >>"$GITHUB_OUTPUT"
 
-      - name: Checkout trusted main controller
+      - name: Checkout staging controller
         uses: actions/checkout@v4
         with:
-          ref: main
+          ref: staging
           fetch-depth: 0
           persist-credentials: false
 
@@ -135,16 +135,15 @@ jobs:
           node frontend/scripts/staging-image-manifest.mjs \
             artifacts/staging-image/manifest.env "$DEPLOY_SHA" >>"$GITHUB_OUTPUT"
 
-      - name: Verify reviewed revision and staging target
+      - name: Verify staging revision and target
         env:
           DEPLOY_SHA: ${{ steps.revision.outputs.sha }}
         run: |
           set -euo pipefail
           git cat-file -e "$DEPLOY_SHA^{commit}"
-          git merge-base --is-ancestor "$DEPLOY_SHA" HEAD || {
-            echo "staging revision is not in the reviewed main history" >&2
-            exit 1
-          }
+          if [ "${{ steps.revision.outputs.allow_rollback }}" = "false" ]; then
+            test "$DEPLOY_SHA" = "$(git rev-parse HEAD)"
+          fi
           test "$DEPLOY_HOST" = "118.26.111.127"
           test "$DEPLOY_PORT" = "22"
           test "$DEPLOY_USER" = "deploy"

.github/workflows/migrate-staging-database.yml

@@ -74,10 +74,10 @@ jobs:
             echo "gate_run_attempt=$gate_run_attempt"
           } >>"$GITHUB_OUTPUT"
 
-      - name: Checkout trusted main controller
+      - name: Checkout staging controller
         uses: actions/checkout@v4
         with:
-          ref: main
+          ref: staging
           fetch-depth: 0
           persist-credentials: false
 
@@ -98,16 +98,13 @@ jobs:
           node frontend/scripts/staging-image-manifest.mjs \
             artifacts/staging-image/manifest.env "$DEPLOY_SHA" >>"$GITHUB_OUTPUT"
 
-      - name: Verify reviewed revision and staging target
+      - name: Verify staging revision and target
         env:
           DEPLOY_SHA: ${{ steps.revision.outputs.sha }}
         run: |
           set -euo pipefail
           git cat-file -e "$DEPLOY_SHA^{commit}"
-          git merge-base --is-ancestor "$DEPLOY_SHA" HEAD || {
-            echo "staging revision is not in the reviewed main history" >&2
-            exit 1
-          }
+          test "$DEPLOY_SHA" = "$(git rev-parse HEAD)"
           test "$DEPLOY_HOST" = "118.26.111.127"
           test "$DEPLOY_PORT" = "22"
           test "$DEPLOY_USER" = "deploy"

.github/workflows/reset-staging-account.yml

@@ -41,10 +41,10 @@ jobs:
       RESET_CONFIRMATION: ${{ inputs.confirmation }}
 
     steps:
-      - name: Checkout trusted controller
+      - name: Checkout staging controller
         uses: actions/checkout@v4
         with:
-          ref: main
+          ref: staging
           persist-credentials: false
 
       - name: Validate account reset request and staging target