feat(security): environment-gate the prod deploy secrets (#329)

DEPLOY_SSH_KEY (prod SSH) and GHCR_READ_TOKEN were repo-scoped Actions
secrets: any workflow on any ref could release them. They now live in the
Production environment (deployment branch policy: main only), and all three
deploy jobs (backend/heartbeat/concierge) declare environment: Production.

The prod SSH key was also rotated to a dedicated CI-only keypair as part of
the move -- the old secret doubled as a personal login key. The old value
keeps working until the repo-scoped copies are deleted after this deploys
green.

A new grep-sentinel test pins the environment reference on the backend
deploy job: once the repo-scoped secrets are gone, dropping the environment
key would make the deploy-gate skip deploys silently, forever.

Closes SEC Root F (finsearch-security-cicd-hardening-08).

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: FlyM1ss

.github/workflows/backend-deploy.yml

@@ -125,6 +125,14 @@ jobs:
   deploy:
     runs-on: ubuntu-latest
     if: ${{ github.ref == 'refs/heads/main' }}
+    # DEPLOY_SSH_KEY / GHCR_READ_TOKEN are ENVIRONMENT secrets (Production has a
+    # deployment branch policy of main only), not repo-scoped: even a workflow
+    # edited or dispatched on a non-main ref cannot release the prod SSH key.
+    # This gates the secret itself, independently of the ref-gate above -- the
+    # two layers fail separately (same stanza as the heartbeat/concierge jobs).
+    environment:
+      name: Production
+      url: https://agenticfinsearch.org
     # Serialize deploys so two merges in quick succession can't land out of order,
     # leave the droplet on the older commit, or -- now that superseded images are
     # retired below -- rmi an in-flight peer's freshly pulled, still container-less

.github/workflows/concierge-tests.yml

@@ -49,6 +49,10 @@ jobs:
     if: ${{ github.ref == 'refs/heads/main' }}
     runs-on: ubuntu-latest
     needs: test
+    # DEPLOY_SSH_KEY is an ENVIRONMENT secret (Production: deployment branch
+    # policy = main only) -- non-main refs cannot release the prod SSH key even
+    # if the ref-gate above is edited away (same stanza as backend/heartbeat).
+    environment: Production
     # Serialize deploys so two merges in quick succession can't land out of order and
     # leave the droplet on the older commit.
     concurrency:

.github/workflows/heartbeat-tests.yml

@@ -43,6 +43,10 @@ jobs:
     if: ${{ github.ref == 'refs/heads/main' }}
     runs-on: ubuntu-latest
     needs: test
+    # DEPLOY_SSH_KEY is an ENVIRONMENT secret (Production: deployment branch
+    # policy = main only) -- non-main refs cannot release the prod SSH key even
+    # if the ref-gate above is edited away (same stanza as backend/concierge).
+    environment: Production
     # Serialize deploys so two merges in quick succession can't land
     # out of order and leave the droplet on the older commit.
     concurrency:

Main/backend/tests/test_dockerfile_nonroot.py

@@ -232,6 +232,19 @@ def test_image_retirement_never_forces_and_never_prunes_all(self):
         self.assertIsNone(re.search(r"\bprune\b[^\n]*(\s-\w*a\b|\s--all\b)", code))
         self.assertIsNone(re.search(r"""--filter[= ]["']?until""", code))
 
+    def test_deploy_job_bound_to_production_environment(self):
+        # DEPLOY_SSH_KEY (the prod SSH key) and GHCR_READ_TOKEN are ENVIRONMENT
+        # secrets on Production, whose deployment branch policy is main-only. The
+        # job must reference that environment or the secrets simply don't resolve
+        # -- and, critically, a workflow edited/dispatched on a non-main ref can
+        # never release them, independently of the ref-gate `if:`. Dropping this
+        # key would silently fall back to... nothing (the repo-scoped copies are
+        # deleted), so the deploy-gate step would skip deploys forever.
+        wf = _read(DEPLOY_WORKFLOW)
+        deploy_job = wf[wf.index("\n  deploy:"):wf.index("Deploy to Fedora droplet")]
+        self.assertIn("environment:", deploy_job)
+        self.assertIn("name: Production", deploy_job)
+
     def test_deploy_job_serialized_by_concurrency_group(self):
         # Without serialization, two quick-succession merges run overlapping deploy
         # scripts against the same droplet: they can land out of order, and the