Add parallel testnet build+deploy to the release pipeline - #9

On prereleased events, callers can now opt into a second, testnet-mode
build (deploy-testnet: true) that deploys to a standalone testnet Worker
via a new 'testnet' environment in deploy-app (direct wrangler deploy
--env testnet). The testnet build uploads its own run artifact
(<app-name>-testnet-build-<sha>) and attaches its own release bundle
(<bundle-prefix>-testnet-bundle<tag>.zip), which also makes testnet
rollbacks possible: app-rollback.yml gains a 'testnet' environment that
redeploys that bundle.

New release-pipeline inputs: deploy-testnet, testnet-build-args
(default --mode testnet), testnet-build-env, testnet-url; new output:
testnet-url.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QZs3qvSwpTvBZEPSqfXQzQ

Drops the deploy-testnet and testnet-url inputs. A new detect-testnet job
parses the caller's wrangler.toml and enables the testnet build+deploy when
an [env.testnet] section exists, taking the GitHub deployment URL from that
section's custom_domain route.

The inputs duplicated a fact wrangler.toml already had to state: an app
cannot deploy a testnet Worker without declaring it there, so requiring a
second "yes I want testnet" flag in the caller workflow only added a place
to drift — and forced every consumer to open a workflow PR to adopt the
feature. Deriving it means adopting testnet is a config change in the app
repo, and because callers pass no inputs an older main would reject, their
PRs no longer have to land after this one.

Parsed with tomllib, not grep, so comments, key order and quoting cannot
change the answer. A malformed wrangler.toml fails the job loudly rather
than reading as "no testnet". actions/deploy-app still greps for the prod
Worker name; that predates this and should follow, but it sits on the gated
promotion path so it is left alone here.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QZs3qvSwpTvBZEPSqfXQzQ

app-promote-production.yml no longer takes a tag input. A new resolve-tag
job looks up GitHub's own "latest release" (GET .../releases/latest, which
excludes drafts and prereleases) and every downstream step — the ancestry
check, the staged-version lookup, the Slack messages — uses that instead
of inputs.tag.

The tag a `released` event just staged is GitHub's latest release at that
exact moment, by construction: prereleased builds it, and flipping the
release out of prerelease (the `released` event) is what fires the Slack
notification asking someone to promote in the first place. So deriving it
loses no legitimate case, while removing the only place an operator could
type an arbitrary tag into this workflow. That capability now only exists
in the already-gated app-rollback.yml, which is what it's for.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QZs3qvSwpTvBZEPSqfXQzQ

One name per tier, used for the pipeline input, the wrangler env and the
GitHub Environment. The main-merge deploy becomes `nightly` (it tracks main)
and the release-tag testnet deploy becomes `demo` (it is the thing you show
someone). `--mode testnet` is untouched: that names the chain, not the
environment.

Only two names still differ from their wrangler env, both because two tiers
share one Worker: staging is a version alias on the prod Worker, and PR
previews are unpromoted versions of the nightly Worker. That collapses the
old four-branch mapping in deploy-app to two special cases.

Retires public-demo, which nothing consumes once apps-management moves to
the demo leg, and which would otherwise collide with the new wrangler
[env.demo].

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QZs3qvSwpTvBZEPSqfXQzQ

The Slack notice, its failure message and the step summary all handed out
`gh workflow run promote-production.yml ... -f tag=<TAG>`. That input no
longer exists, so gh rejects the call with HTTP 422 — the notification was
telling deployers to run a command that cannot work.

Drops the input from the command and says in the message that promotion
targets GitHub's latest release, so the reader knows to release the tag
first rather than passing it.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QZs3qvSwpTvBZEPSqfXQzQ