chore(ci): unreachable Fargate caller job in deploy-all, dead range check in sanity CLI #314

Summary

Two low-severity dead paths in CI code. deploy-all.yml writes the literal deploy-aws-fargate=false for every value of deploy_to, so the deploy-aws-fargate caller job's if: can never be true; the aggregate summary then prints "AWS Fargate: Skipped" as if that were a configured choice, and the README lists Fargate as job 3 of the fan-out under all. Severity is low because deploy-aws-fargate.yml remains directly dispatchable and the README already documents aws-only as Lambda only, so no deployment capability is lost. In the sanity CLI, requireInt32Range already exits 2 for any value outside [1, MaxInt32], so the identical inline check on the next lines is unreachable, is the only consumer of the math import, and spells the same bound two ways (1<<31-1 and math.MaxInt32) that must be kept in sync by hand.

Location

All at 3c0f8ac94048a2c36fce5ccddee54e6c4849a5cd.

• A14-018 .github/workflows/deploy-all.yml:127 (hardcoded false), :185 (the never-true if:); README.md:247, :263. Add an explicit aws-fargate value to the deploy_to choice list and drive the output from it, or delete the caller job and its README entry. Note LeanerCloud/cloud-commitments-cli#1810 relies on the job being permanently skipped when reasoning about notify's needs; re-check that reasoning if the job becomes reachable.
• A14-040 ci_cd_sanity_tests/cmd/sanity/main.go:32-35 (duplicate check) after requireInt32Range("--max-list", *maxList) at :30, whose bound is at :16. Delete lines 32-35 and the math import, and use math.MaxInt32 inside requireInt32Range.

Failure scenario

An operator selecting all for a disaster-recovery deploy gets Lambda only and a summary line that looks intentional. The sanity duplicate has no runtime effect.

Evidence

# AWS Fargate (optional, can be enabled separately)
echo "deploy-aws-fargate=false" >> "$GITHUB_OUTPUT"

requireInt32Range("--max-list", *maxList)

if *maxList < 1 || *maxList > math.MaxInt32 {
    fmt.Fprintf(os.Stderr, "ERROR: --max-list must be between 1 and %d, got %d\n", math.MaxInt32, *maxList)
    os.Exit(2)
}

Suggested fix

Per checkbox above.

Found by the 2026-09-02 codebase audit, findings A14-018, A14-040, each reported by one reviewer and independently confirmed by a second. Full report: docs/audits/codebase-audit-2026-09-02.md.