fix: harden staging deployment controls

.github/workflows/deploy-staging.yml

@@ -6,13 +6,13 @@ on:
     types: [completed]
   workflow_dispatch:
     inputs:
-      git_ref:
-        description: Tested branch, tag, or commit SHA to deploy
+      git_sha:
+        description: Exact 40-character commit SHA from a successful CI run
         required: true
-        default: staging
 
 permissions:
   contents: read
+  actions: read
 
 concurrency:
   group: staging
@@ -39,14 +39,39 @@ jobs:
       STAGING_KNOWN_HOSTS: ${{ vars.STAGING_KNOWN_HOSTS }}
 
     steps:
+      - name: Validate tested revision
+        id: revision
+        env:
+          REQUESTED_SHA: ${{ github.event.workflow_run.head_sha || inputs.git_sha }}
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          test "${#REQUESTED_SHA}" -eq 40
+          case "$REQUESTED_SHA" in
+            *[!0-9a-fA-F]*) echo "git_sha must be a full hexadecimal commit SHA" >&2; exit 1 ;;
+          esac
+          DEPLOY_GIT_SHA="$(printf '%s' "$REQUESTED_SHA" | tr '[:upper:]' '[:lower:]')"
+          if [ "$GITHUB_EVENT_NAME" = "workflow_dispatch" ]; then
+            TESTED_RUNS="$(curl --fail --silent --show-error \
+              --header "Authorization: Bearer $GH_TOKEN" \
+              --header "Accept: application/vnd.github+json" \
+              --header "X-GitHub-Api-Version: 2022-11-28" \
+              "$GITHUB_API_URL/repos/$GITHUB_REPOSITORY/actions/workflows/ci.yml/runs?head_sha=$DEPLOY_GIT_SHA&status=success&per_page=1")"
+            test "$(printf '%s' "$TESTED_RUNS" | jq -r '.total_count')" -ge 1 || {
+              echo "No successful Jyotish Skill CI run found for $DEPLOY_GIT_SHA" >&2
+              exit 1
+            }
+          fi
+          echo "sha=$DEPLOY_GIT_SHA" >> "$GITHUB_OUTPUT"
+
       - name: Checkout tested revision
         uses: actions/checkout@v4
         with:
-          ref: ${{ github.event.workflow_run.head_sha || inputs.git_ref }}
+          ref: ${{ steps.revision.outputs.sha }}
 
-      - name: Resolve deployment SHA
-        id: revision
-        run: echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
+      - name: Verify checked-out revision
+        env:
+          DEPLOY_GIT_SHA: ${{ steps.revision.outputs.sha }}
+        run: test "$(git rev-parse HEAD)" = "$DEPLOY_GIT_SHA"
 
       - name: Validate staging target configuration
         run: |
@@ -77,8 +102,7 @@ jobs:
           ssh $SSH_OPTIONS "$DEPLOY_USER@$DEPLOY_HOST" "install -d -m 755 '$DEPLOY_PATH'"
           rsync -az --delete \
             --exclude='.git/' \
-            --exclude='.env.production' \
-            --exclude='.env.staging' \
+            --exclude='.env*' \
             --exclude='frontend/node_modules/' \
             --exclude='frontend/.next/' \
             -e "$RSYNC_SSH" \