ci(release): protect Cloudflare deployment dispatch

Gate Worker releases on protected-main environment policy and an
exact-SHA successful Static Checks run. Reject invalid refs before
checkout or dependency installation.

Author: iamjr15

.github/workflows/deploy-cloudflare.yml

@@ -8,14 +8,36 @@ concurrency:
   cancel-in-progress: false
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
   deploy:
     name: Deploy Workers
     runs-on: ubuntu-24.04
     timeout-minutes: 45
+    environment: Production
     steps:
+      - name: Require main
+        run: test "$GITHUB_REF" = "refs/heads/main"
+
+      - name: Require successful static checks for this commit
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          successful_runs="$(gh api --method GET \
+            "repos/${GITHUB_REPOSITORY}/actions/workflows/static-checks.yml/runs" \
+            --field branch=main \
+            --field event=push \
+            --field head_sha="$GITHUB_SHA" \
+            --field per_page=1 \
+            --field status=success \
+            --jq '.total_count')"
+          if [ "$successful_runs" -lt 1 ]; then
+            echo "Static Checks has not succeeded for $GITHUB_SHA on main." >&2
+            exit 1
+          fi
+
       - name: Checkout reviewed release
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
@@ -25,9 +47,6 @@ jobs:
         with:
           release-sha: ${{ github.sha }}
 
-      - name: Require main
-        run: test "$GITHUB_REF" = "refs/heads/main"
-
       - name: Build Worker release
         run: >-
           pnpm exec turbo run build