CD: publish images to GHCR, create Sentry releases, deploy to dev #10

Temporary routing (2026-10-08): Pull requests publish to GHCR and deploy that SHA to Azure dev. Merges to main deploy to prod. Prod is fail-closed until #12 / prod secrets exist. This overrides main → dev in the original body. Draft CD: #67. ADR 0010.

Context

CI already checks every PR: lint, type-check, tests with coverage, build and Docker build. CD now publishes images (PR 67). Azure dev apply (#9) is blocked on GHCR 401 until the package exists and is public.

Depends on #9 for the Container App itself. Prod stack is #12.

Goal (temporary)

• PRs → ghcr.io/pixelbar/pixel:<sha> + deploy to Azure dev
• main → same image toward prod (fail closed if Terraform/secrets are missing)
• Original goal (main → dev, prod later with approval) is paused until this routing is reverted.

Scope

• Publish images: ghcr.io/pixelbar/pixel tagged with the git SHA (and pr-<n> / moving main). The package is public, because the image holds no secrets
• Deploy to dev from PRs: roll out the SHA, authenticating to Azure with OIDC (Terraform bootstrap: remote state and GitHub OIDC #8)
• Deploy to prod from main: only when Prod environment, approval gate and go-live in the Pixelbar server #12 and prod Key Vault secrets exist; never copy the Mini/dev Discord token
• Sentry release (still later): a release per deploy, with source maps uploaded so stack traces point at the TypeScript source
• Command registration (still later): register slash commands as part of the deploy

Acceptance criteria

• A PR SHA is pullable from GHCR (package public) and, once pixel-dev exists and ARM_* is set, that SHA is running on dev (one replica)
• Merge to main publishes the SHA; prod deploy fails closed until Prod environment, approval gate and go-live in the Pixelbar server #12 / prod secrets exist
• Verified that the image contains no .env, access lists, block list or other secrets
• A failed deploy leaves the app on the previous working version, or rollback is one documented step
• Workflow permissions stay minimal: only the publishing job can write packages
• Actions pinned to commit SHAs, as in the existing CI
• Sentry shows the release, and stack traces map to .ts files and lines (later)

Considerations

• Provenance and SBOM for published images would be nice to have
• Whether to register commands from CI or from the app on startup
• Image tags: SHA pin plus moving pr-<n> / main; never latest as the only pin