feat(repo): preview every pull request and deploy production after the release gate

[systemfsoftware-maker]

Lake 1, U13, stacked on #50. Trimmed per Kiro's 2026-10-06 ruling: previews and a plain production deploy stay, guarded by is_template; no Workers Issues automation, no version check or rollback, no Alchemy patch.

• .github/workflows/previews.yml: a same-repo pull request in an adopter's copy deploys as its pr-<N> stage, gets its URL in one PR comment (edited on every push), and is destroyed when the PR closes. Fork PRs and the template itself get none.
• .github/workflows/release-gate.yml gains deploy · production: on main, once the plan passed and the mutation job passed (every shard at break 100) or was skipped (no decisions to mutate, ci(ci): move mutation to a release gate on main #35), pnpm run deploy (to vars.SITE_DOMAIN when that repository variable is set). A failed plan, a failed shard or a cancelled run never deploys.
• .github/actions/cloudflare-secrets fails both jobs early, naming any missing secret.
• Cloudflare credentials enter a sandbox only through bin/cloud (deploy, destroy, state reads). AGENTS.md states that boundary as a rule.

Alchemy patch: dropped. Deploy does not need it; its two hunks served only the CloudflareTracer subpath (traces, #45) and the Workers Issues reconcile (trimmed here).

Gate at bcd99ef, before the restack onto #35's no-decisions rule (the deployed-journeys lines it carried are gone with F11)

$ pnpm check:ci
checkci=1        # only check:sfs-sources, inherited from #52
$ pnpm journeys
journeys=0

Not exercised here: a preview or production run, which needs an adopter's copy and its secrets.

Restack, 2026-10-06

Rebased onto #35's no-decisions rule. The deploy job's condition (needs: [plan, mutation], !cancelled() && plan == success && mutation in {success, skipped} && !is_template) is the only change in this layer's tree; actionlint passes on it.

Cycle 35 (Kiro rulings on starter-verify's review)

• F11 (93b958c): the deployed-site journeys are not in the spec, so they come out: bin/journeys-deployed, the journeys:deployed script, the journeys and artifact-upload steps in previews.yml and release-gate.yml (the uploads carried only what those journeys wrote), the README line, and the AGENTS.md clause, whose rule keeps a grounded wrong/right pair. Deploy, the preview comment and destroy are unchanged; the preview job is named preview · deploy. No reference to journeys:deployed or journeys-deployed remains on this branch.

Gate after the cycle 52 restack (Linux only)

Gate at c7b0037, clean worktree, Linux, sandboxed:

$ pnpm bootstrap                    # exit 0
$ pnpm check:ci                     # exit 1, only check:sfs-sources:
check-sfs-sources: 2 @systemfsoftware/* package(s) resolve from the npm registry, not the systemfsoftware flake
 Tasks:    8 successful, 8 total   # lint, typecheck, test, build
 Tasks:    1 successful, 1 total   # dist
ok | 1 passed (9 steps) | 0 failed  # sandbox proofs
$ pnpm journeys                     # exit 0
Tests  1 passed (1)

CI run 37573586754 on c7b0037: 6 of 7 jobs pass (format, lint, typecheck, test, dist, journeys); check (sfs-sources) fails, the same red as the local gate above.

Gate after cycle 83 (every @systemfsoftware/* package from our flakes, #52)

Gate at 2a15ef0, clean worktree, Linux, sandboxed:

$ pnpm bootstrap                    # exit 0
$ pnpm check:ci                     # exit 0
check-sfs-sources: all 16 @systemfsoftware/* packages resolve from the systemfsoftware flake
 Tasks:    8/8 successful, 8/8 total   # lint, typecheck, test, build
 Tasks:    1 successful, 1 total   # dist
ok | 1 passed (9 steps) | 0 failed  # sandbox proofs
$ pnpm journeys                     # exit 0
Tests  1 passed (1)

CI run 37675953316 on 2a15ef0: all 7 jobs pass, check (sfs-sources) included. The exit 1 gates above are from before the stryker packages came from the stryker-js-effect flake.

[github-actions]

Preview pr-51

https://endgame-site-pr-51-wz4fag7e6blrocm4.drdgvhbh.workers.dev

Preview run

[kiro-systemf]

Verified: all checks green on da833eb, 0 threads, hunt clean.