Gate production promotion and rollback behind a GitHub-identity allowlist

[gpmayorga]

What

Production promotion moves from "a Cloudflare admin runs wrangler by hand" to a GitHub-gated dispatch flow mirroring centrifuge/backend's activate-production model:

1. released event → app-build-deploy-release.yml still does not deploy. It posts a Slack notification carrying the promotion command (gh workflow run promote-production.yml --ref main -f tag=<TAG>) and a link to the dispatch page.
2. New app-promote-production.yml (workflow_call, dispatched via each app's thin promote-production.yml caller):
   • authorize job: must be dispatched from main (the workflow YAML on main is the trust root), and the actor must appear in the caller's AUTHORIZED_DEPLOYERS repository variable, passed as the authorized-deployers input — empty fails closed. Failed attempts are announced to Slack.
   • promote job (environment: production): verifies the tag's commit is on main, resolves the Worker version staged for the tag (versions list by workers/tag annotation), shifts traffic (versions deploy <id>@100%), announces to Slack, and notifies on failure with a reason.
3. app-rollback.yml gains the same allowlist gate — previously any repo write user could shift production traffic by dispatching a rollback. authorized-deployers is declared optional purely for parse-compat with callers already on main; an empty value refuses to roll back at runtime. Optional slack-webhook-url secret for failed-attempt alerts.

Also adds a CODEOWNERS (deployment/secret-sensitive paths → @gpmayorga / @hieronx / @gregory-kf) and updates the README for the new model. Security-focused CLAUDE.md guidance lives in #11.

Why

GitHub environment protection (required reviewers) is unavailable on private non-Enterprise repos, and the Cloudflare token cannot be scoped to forbid version deploys. The previous notify-only approach removed the unattended path but left rollback ungated and promotion un-audited. This model:

• ties promotion to a GitHub identity with a native audit trail (workflow runs + Slack alerts on failed attempts)
• tightens the rollback path (was: any write user; now: allowlist, fail-closed)
• removes the need for humans to hold Cloudflare prod tokens for routine releases

It remains a process control, not a hard control: anyone holding a Worker-deploy-capable token can promote out-of-band, and repo admins can edit the allowlist variable. The hard boundary — repo access + branch protection + CODEOWNERS on .github/workflows/** — is handled repo-settings-side.

Contract changes (callers must update)

• app-build-deploy-release.yml: new required secret slack-webhook-url; new optional inputs production-worker-name, production-url; production-url output removed; the notification links to the caller's promote-production.yml (name the caller exactly that).
• app-promote-production.yml (new): inputs tag, app-name, production-worker-name, cloudflare-account-id, authorized-deployers, optional production-url; secrets cloudflare-api-token, slack-webhook-url.
• app-rollback.yml: new input authorized-deployers (parse-optional, runtime fail-closed), new optional secret slack-webhook-url. ⚠️ After this merges, rollback dispatches from callers still on the old contract fail closed until the consumer PRs land and AUTHORIZED_DEPLOYERS is created.

Rollout / merge order

1. Merge this first. Consumer PRs (centrifuge/apps-invest#268, centrifuge/apps-management#1151) reference this branch while under review; they flip to @main before merging.
2. Each app repo needs the AUTHORIZED_DEPLOYERS repository variable (comma-separated GitHub usernames) before the first promotion or rollback.
3. Docs PR Add CLAUDE.md with security and deployment guidance #11 can merge after (or in parallel); it documents the model this PR ships.

Verification

• yamllint (relaxed, line-length off — matches lib-ci) clean; caller with:/secrets: keys cross-checked against the workflow_call contracts of both consumer PRs.
• Live validation of the promote flow needs a throwaway prerelease→release after merge (dispatch touches real Cloudflare); the notify path posts to Slack only.

[gpmayorga]

Split CLAUDE.md out to #11 so docs can review separately from the gate/workflows/CODEOWNERS changes.