chore(catalog): harden deployment workflow

[kitlangton]

What

Makes catalog deployment safer and easier to trigger from GitHub Actions. The workflow continues to deploy relevant changes merged to main and supports manual dispatch.

How

• Pins Wrangler to the Anomaly Cloudflare account so local and CI deployments cannot silently target a personal account.
• Associates deployments with the catalog-production GitHub environment and live URL.
• Adds a deployment timeout and post-deploy health check.
• Documents automatic, manual, and exceptional local deployment procedures in apps/catalog/AGENTS.md.

Scope

The repository still needs access to the organization-level CLOUDFLARE_API_TOKEN Actions secret. The catalog-production environment has already been created.

Testing

• bun run check in apps/catalog
• bunx wrangler deploy --dry-run in apps/catalog
• git diff --check
• 37 catalog tests pass

Flow

sequenceDiagram
  participant GitHub as GitHub Actions
  participant Catalog as Catalog checks
  participant Cloudflare as Cloudflare Workers
  participant Live as dev.opencode.ai
  GitHub->>Catalog: Validate Drive and catalog
  Catalog-->>GitHub: Checks pass
  GitHub->>Cloudflare: Deploy with repository secret
  Cloudflare-->>GitHub: Deployment complete
  GitHub->>Live: Verify HTTP health

Loading