CI/CD: build, scan, migrate, deploy and automatic rollback

[FullFran]

Automate what is currently manual.

Scope

• GitHub Actions: lint, typecheck, unit and integration tests on every PR
• Build a multi-arch image and push to GHCR, tagged with the commit SHA —
  never deploy latest
• Trivy or equivalent image vulnerability scan, failing on high severity
• Run the migration Job, then roll out the new image
• Wait for rollout status and roll back automatically on failure
• Run smoke:stack:run against the deployed environment as a post-deploy gate
• Deploy to dev on merge to main; prod behind a manual approval

Notes

The rollback path is the part most pipelines skip and the part that gets asked
about. A deploy that cannot undo itself is not automated, it is just faster to break.