The previous pass's patch loop aborted on an assertion partway through,
leaving frontend-deploy, backend-deploy-prod, and frontend-deploy-prod
still keying on GITHUB_SHA -- which is why their re-proof dispatches went
looking for images tagged with promotion-merge tips. Same fix as the
rest: full-depth checkout + git log -1 -- <domain>/.
Backend runs its full hermetic suite, frontend its unit tier, inside the
just-built image -- the dev-only feature both app repos carried in their own
build.yml (deleted here in favor of the root workflow).
One root workflow set replaces the four repos' copies (deleted -- root-only
is where Forgejo reads them, and dead copies are a trap): per-domain
build-push with explicit image paths (emi/thermograph/backend|frontend; the
old github.repository-derived path collides in a monorepo), path-filtered
per-domain beta/prod/dev deploys, a domain-input reusable build check, a
single always-reporting PR gate (path-filtered required checks deadlock
auto-merge), a new infra-sync pipeline (host checkout + secrets render on
infra/** pushes), and ports of secrets-guard / ops-cron /
observability-validate to monorepo paths.
