Chore: deploy CommandGrid preview from main

[RobinOppenstam]

Summary

• Add a gated deploy-preview job to the existing CI workflow.
• Deploy commandgrid-preview only after the CI check job succeeds on push to main.
• Allow manual workflow_dispatch preview deploys, guarded so deploy only runs from refs/heads/main.
• Document required GitHub Actions secrets/config for Cloudflare preview deploys.

Root cause

main CI was building the Cloudflare bundle with npm run cf:build, but no workflow step deployed the preview Worker, so preview could become stale after merges.

Workflow behavior

• Pull requests: run existing CI checks only; no deploy.
• Push to main: run existing CI checks first, then deploy preview with npx wrangler deploy --env preview.
• Manual dispatch: deploy job is available only when dispatched from main.
• Production is not deployed.

Required secrets/config

• CLOUDFLARE_API_TOKEN
• CLOUDFLARE_ACCOUNT_ID
• CLOUDFLARE_HYPERDRIVE_LOCAL_CONNECTION_STRING_COMMANDGRID_DB

The workflow verifies these are present by name before deploying and does not print secret values.

Verification

• npm ci
• npm run lint
• npm run typecheck
• npm test
• npm run cf:build
• .github/workflows/ci.yml parsed with PyYAML and reviewed by inspection.
• gh workflow view ci.yml --ref chore/cloudflare-preview-deploy-workflow --yaml
• PR check check passed; deploy-preview skipped on PR branch by design.

Risks / notes

• GitHub repository or environment secrets must be configured before the deploy job can succeed.
• If a manual workflow is dispatched from a non-main ref, the deploy job is skipped by design.
• Requesting Scout review.