ci(deploy): deploy pre-built images tagged by commit SHA

[alanpeixinho]

What it is

Staging and production deploy pre-built GHCR images by commit SHA instead of :latest or on-server builds.

• Publish GHCR Images — Manual ref; images tagged with resolved SHA; :latest only on push to main.
• Staging — CI passes github.sha; pull + up --no-build; optional manual deploy with image_tag.
• Production — Required image_tag (SHA); pulls that tag; DASHBOARD_VERSION from deployed commit.
• Staging compose image paths match .env.example; docs updated.
  Do not run Deploy production Dashboard for this PR.

How to test

1. Publish (no staging, no prod)

1. Push this branch.
2. Repo Actions → Publish GHCR Images → Run workflow.
3. Use workflow from this branch. Set ref to this branch (required).
4. Open the run → Summary: Commit SHA: <sha> is the commit you built.
5. Confirm tags in GHCR (https://github.com/orgs/kernelci/packages):

• dashboard-backend, dashboard-frontend, dashboard-proxy each have a tag equal to that full SHA.
• On this manual run, the latest tag digest should be unchanged (compare digest before vs after).

2. Negative staging (no host change)

1. Actions → Deploy Staging and E2E → Run workflow from this branch (we cannot run this via UI until the PR is merged, so we need to run this action via cli with gh workflow run "Deploy Staging and E2E" \ --repo kernelci/dashboard \ --ref chore/deploy-sha-images \ -f image_tag=<commit tag from the published image>).
2. Set image_tag to a fake SHA.
3. Open the run → job check-migrations should fail on actions/checkout (ref not found).
4. Job deploy-staging must not run (no SSH).

3. Manual staging (optional — live staging)

Same workflow as (2), image_tag = SHA from (1). This updates staging.

1. Run Summary: Deploying staging with IMAGE_TAG=<sha>.
2. Same Summary, table Staging deployment status, column Image:

• ghcr.io/kernelci/dashboard/dashboard-backend:<sha>
• same for dashboard-frontend and dashboard-proxy.

3. Do not use the staging site version string; that is git describe, not the image tag.

4. After merge to main (live staging; existing CI behavior)

Two runs, same merge commit. Actions at https://github.com/kernelci/dashboard/actions.
CI

1. Left: CI for KernelCI Dashboard.
2. Open the run with event push (not pull_request). Title is the merge commit.
3. Run header shows the commit SHA (github.sha).
4. Jobs: call-deploy-staging / Deploy Staging and E2E must run (skipped = you opened the PR CI run).
5. Open job deploy-staging → run Summary:

• Deploying staging with IMAGE_TAG=<sha> equals the header SHA.
• Staging deployment status → Image column uses …/dashboard-*: <same sha>, not :latest.
  Publish

1. Left: Publish GHCR Images.
2. Open the run for that same commit.
3. Summary: Commit SHA: <sha> matches IMAGE_TAG from the CI staging job.
   Discord only fires if staging fails; success is Actions Summary only.

Closes #2087.