refactor(ci): split ci.yml into ci.yml + deploy.yml

[fullstackjam]

Summary

The single ci.yml workflow (named CI / Deploy) was doing both CI and CD with one ambiguous badge — you couldn't tell whether a red badge meant a failed test or a failed deploy. Splits into two workflows so each concern has its own badge.

• ci.yml (name: CI) — runs on PR + push to main + repository_dispatch (contract updates). One job (check): type check, tests + coverage, build, contract schema validation.
• deploy.yml (name: CD) — triggered via workflow_run after CI succeeds on main. Builds, applies D1 migrations, deploys via wrangler-action, runs health check + smoke test + post-deploy contract round-trip.

README now shows two badges. docs/HARNESS.md post-deploy rows point at deploy.yml. required-checks.txt is unchanged — check and validate-commits are still required, both still exist as job names.

Also folds in the three post-merge review findings on #7 (api-reference inaccuracies):

• List Configs example: drop fields getUserConfigs does not SELECT (user_id, custom_script, dotfiles_repo, forked_from, created_at).
• Get Current User: add avatar_url back — it is selected by getCurrentUser.
• Install endpoint auth note: replace the vague "browser-friendly auth flow" claim with the actual behaviour (404 on the page route for non-owners; no interactive prompt).

Test plan

• npm run check — 0 errors
• npm run validate ran in pre-push hook on push
• First post-merge: confirm ci.yml runs and turns the CI badge green
• Confirm deploy.yml fires via workflow_run and turns the CD badge green
• Confirm /api/health reports healthy after CD finishes
• Confirm required-checks alignment (drift) sensor on harness.yml still passes

Risk

workflow_run triggers run from the default branch's workflow file, so the very first deploy after this merge uses deploy.yml as-merged on main — there's no chicken-and-egg. If the deploy job has a bug, the fallback is wrangler deploy from a clean checkout (covered by AGENTS.md as a manual step).

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!