chore(release): add manual Cloudflare deployment (#68)

## Summary
- add a manual-only production workflow for affected Cloudflare Workers
- pin Wrangler 4.114.0 and allow bounded deploys up to 15 minutes
- remove obsolete Knip suppressions while keeping runtime entry
discovery explicit

## Validation
- `pnpm lint`
- `pnpm typecheck`
- `pnpm architecture:check`
- `pnpm deadcode`
- `pnpm build`
- `actionlint .github/workflows/*.yml`
- `git diff --check`

Author: iamjr15

.github/workflows/deploy-cloudflare.yml

@@ -0,0 +1,40 @@
+name: Deploy Cloudflare
+
+on:
+  workflow_dispatch:
+
+concurrency:
+  group: deploy-cloudflare-production
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
+jobs:
+  deploy:
+    name: Deploy affected Workers
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      - name: Checkout reviewed release
+        uses: actions/checkout@v4
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 11.15.0
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: .nvmrc
+          cache: pnpm
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Deploy affected Workers
+        run: pnpm cloudflare:deploy
+        env:
+          CLOUDFLARE_ACCOUNT_ID: ${{ vars.CLOUDFLARE_ACCOUNT_ID }}
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}

knip.jsonc

@@ -17,16 +17,14 @@
       "entry": ["drizzle.config.ts", "src/schema/drizzle.ts"]
     },
     "infra/containers/sandbox/browser-driver": {
-      // The snapshot launches this service from the immutable browser-driver
-      // launcher. Playwright and Zod are Stagehand peers, and the Docker build
-      // invokes Playwright's CLI to install the matching Chromium artifact.
-      "entry": ["server.js"],
+      // The snapshot installs these as Stagehand runtime peers. Knip cannot see
+      // that dependency edge because it is resolved inside the Docker image.
       "ignoreDependencies": ["playwright-core", "zod"]
     },
     "infra/containers/sandbox/skill-runtime": {
       "entry": ["bin/*.mjs"],
       // Snapshot launchers resolve these executables by installed binary name;
-      // neither child-process execution nor Docker symlinks are visible to Knip.
+      // Knip cannot infer that Docker runtime edge.
       "ignoreDependencies": ["agent-browser", "tsx"],
       "ignoreBinaries": ["agent-browser"]
     }