ci: per-service deploy workflow template (path-filtered, independent)

[tomymaritano]

Context

The point of the split is independent deployability: each service deploys on changes to its own path, with its own smoke test, without touching the others. Current deploy-api.yml deploys the whole monolith.

Acceptance criteria

• Reusable GitHub workflow: path filter → typecheck/test → wrangler deploy staging → smoke test (/health + contracts validation) → production on main
• FAIL LOUD: no continue-on-error anywhere; deploy failure notifies
• Rollback runbook: wrangler rollback per service
• Applied first to the existing monolith worker (deploy-api.yml refactored into the template shape) so later services just instantiate it

Depends on

Topology issue.