fix: validate staging runtime before deploy

deploy/README.md

@@ -155,7 +155,7 @@ CADDYFILE_PATH=./Caddyfile.staging
 SITE_ADDRESS=https://staging.jyotisha.chat
 ```
 
-Before deploying, run `docker compose --env-file .env.staging -f deploy/docker-compose.server.yml config --quiet` on the server. The first deployment should be manual:
+After source sync and before `up`, the workflow validates `.env.staging` mode/selectors and runs `docker compose --env-file .env.staging -f deploy/docker-compose.server.yml config --quiet`. For later manual inspections, run the same checks only after the tracked deployment files exist on the server. The first deployment should be manual:
 
 1. Confirm `/opt/jyotisha-staging/.env.staging` exists, has mode `0600`, and contains the three selectors above.
 2. Open GitHub Actions -> Jyotish Skill CI -> Run workflow, using workflow from `main`.

deploy/validate-staging-env.sh

@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ENV_FILE="${1:-.env.staging}"
+
+if [ ! -f "$ENV_FILE" ]; then
+  echo "staging environment file is missing: $ENV_FILE" >&2
+  exit 1
+fi
+
+if MODE="$(stat -c '%a' "$ENV_FILE" 2>/dev/null)"; then
+  :
+else
+  MODE="$(stat -f '%Lp' "$ENV_FILE")"
+fi
+
+if [ "$MODE" != "600" ]; then
+  echo "staging environment file must have mode 0600" >&2
+  exit 1
+fi
+
+require_selector() {
+  local key="$1"
+  local expected="$2"
+  local count
+
+  count="$(grep -c "^${key}=" "$ENV_FILE" || true)"
+  if [ "$count" -ne 1 ] || ! grep -Fqx "${key}=${expected}" "$ENV_FILE"; then
+    echo "invalid staging selector: $key" >&2
+    exit 1
+  fi
+}
+
+require_selector APP_ENV_FILE ../.env.staging
+require_selector CADDYFILE_PATH ./Caddyfile.staging
+require_selector SITE_ADDRESS https://staging.jyotisha.chat
+
+echo "staging environment selectors: valid"