ci: gate the release branch on deploy-test

[laazyj]

What & why

Follow-up to #345. Two placements were wrong for the same underlying reason — neither tested the tree being released:

• In release-tag.yml (ci: gate the release tag on deploy-test #345, on main): the deploy runs after the release PR is merged, so feedback lands after the release decision.
• In release-prepare.yml (this PR's first revision): a reusable workflow runs at the caller's ref, so it would have deployed main's HEAD — a different tree from the release branch.

deploy-test.yml now also triggers on push: release/**. The release branch is the only ref holding exactly what ships, version bumps and CHANGELOG.md included, and release-prepare.yml pushes it with the PAT — so the deploy starts by itself the moment the release PR exists, and lands as a check on that PR next to CI.

release-prepare.yml  ──push release/vX.Y.Z──►  deploy-test.yml   ← the gate
                     └──opens the release PR ──► CI                 (check on the PR)
        │ squash-merge, once both are green
        ▼
release-tag.yml  ──tag──►  release.yml   (GitHub Release → npm)

release-tag.yml reverts to a single tag job; the parse split in #345 existed only to protect the deploy it no longer owns.

A trigger, not a wrapper workflow

The first draft of this was a 35-line release-deploy-test.yml that did nothing but uses: ./.github/workflows/deploy-test.yml. Adding the trigger to deploy-test.yml directly is better: sandbox-cleanup.yml keys off top-level workflow names, and a second name is one more thing nothing validates when it drifts — rename the wrapper and teardown silently stops firing for the release path. Its listener list goes back to [Deploy Test], with a note about what to do if deploy-test.yml is ever called as a reusable workflow again.

That needs one fix: environment: gains the || 'sandbox' fallback the concurrency group already had, since a push event carries no inputs and an empty environment binding would silently drop AWS_ROLE_ARN/AWS_REGION.

Worth knowing

• Enforcement is the merge checklist, not branch protection. Required status checks are configured per base branch, so requiring Deploy Test on main would block every PR — it only ever runs on release/**. The PR body now lists it explicitly.
• RELEASE_PR_TOKEN gains a third reason to exist. The branch push only triggers the gate because it is PAT-authenticated; under GITHUB_TOKEN the release PR would simply have no Deploy Test check. Documented alongside the other two.
• CI runs twice on a release branch push — once for the PR's merge ref, once inside deploy-test.yml for the branch tip. On a freshly cut branch those are the same tree. docs/ci.md now says so rather than implying otherwise; a run-ci input on deploy-test.yml would remove it, but that is a separate change.
• Also corrects three places (ci.yml, coverage-comment.yml, docs/ci.md) that still named release.yml as ci.yml's workflow_call caller — stale since the deploy left that workflow.
• The docs/ci.md pipeline diagram is redrawn top-to-bottom with the trigger written on each edge; the old side-by-side layout was built for a linear chain and had edges landing on the wrong boxes.

Verification

actionlint clean on all workflows; npm run verify passes. The path is exercised by the next Release Prepare dispatch — the branch push should produce a Deploy Test run against release/vX.Y.Z, visible in the PR's checks.

Checklist

• Linked to an issue (or it's a small, obvious fix)
• npm run verify passes locally
• Tests added/updated for the change — n/a, workflow-only

🤖 Generated with Claude Code

[github-actions]

Coverage

Overall line coverage: 99.34% across 23 package(s).

Package	Statements	Branches	Functions	Lines
acm	🟢 97.36%	🟢 94.73%	🟢 100.00%	🟢 97.22%
apigateway	🟢 100.00%	🟢 100.00%	🟢 100.00%	🟢 100.00%
budgets	🟢 99.20%	🟢 95.55%	🟢 100.00%	🟢 100.00%
cloudformation	🟢 97.69%	🟢 95.40%	🟢 100.00%	🟢 99.16%
cloudfront	🟢 99.40%	🟢 95.14%	🟢 100.00%	🟢 100.00%
cloudwatch	🟢 95.56%	🟡 89.55%	🟢 100.00%	🟢 98.23%
core	🟢 100.00%	🟢 97.36%	🟢 100.00%	🟢 100.00%
custom-resources	🟢 100.00%	🟢 100.00%	🟢 100.00%	🟢 100.00%
dynamodb	🟢 100.00%	🟢 92.00%	🟢 100.00%	🟢 100.00%
ec2	🟢 98.81%	🟢 97.72%	🟢 100.00%	🟢 99.58%
eslint-plugin	🟡 89.88%	🟡 83.33%	🟢 100.00%	🟢 97.90%
events	🟢 98.66%	🟢 94.59%	🟢 100.00%	🟢 100.00%
examples	🟢 95.83%	🟡 78.12%	🟢 100.00%	🟢 99.26%
iam	🟢 100.00%	🟢 100.00%	🟢 100.00%	🟢 100.00%
lambda	🟢 98.00%	🟢 96.77%	🟢 100.00%	🟢 98.41%
logs	🟢 100.00%	🟢 100.00%	🟢 100.00%	🟢 100.00%
module-compat	🟢 100.00%	🟢 100.00%	🟢 100.00%	🟢 100.00%
neptune	🟢 97.14%	🟡 86.36%	🟢 100.00%	🟢 98.50%
route53	🟢 98.24%	🟢 96.04%	🟢 100.00%	🟢 99.04%
s3	🟢 100.00%	🟢 100.00%	🟢 100.00%	🟢 100.00%
ses	🟢 100.00%	🟢 100.00%	🟢 100.00%	🟢 100.00%
sns	🟢 100.00%	🟢 100.00%	🟢 100.00%	🟢 100.00%
sqs	🟢 100.00%	🟢 98.55%	🟢 100.00%	🟢 100.00%
Total	🟢 98.08%	🟢 94.70%	🟢 100.00%	🟢 99.34%