Test on PRs, auto-deploy staging, gate prod

[keval6b]

Summary

• PRs run uv run pytest (fakes, no AWS deploy).
• Push to main waits for tests, then auto-applies staging (environment: stg, no reviewers) and syncs a PostHog-free frontend.
• Production still uses a saved plan plus the prd approval gate, and does not start until staging apply succeeded.

Trust / env

The staging job assumes vars.AWS_DEPLOY_ROLE_ARN with OIDC subject environment:stg. Allow that in the deploy role trust (alongside environment:prd), and create a GitHub Environment named stg with no required reviewers. AWS_DEPLOY_ROLE_ARN needs to be visible to that job (repo variable, not only the prd environment).

Test plan

• Open this PR and confirm the Test workflow runs pytest only
• After merge, confirm staging apply runs without approval
• Confirm the prd apply job still waits for review and only then after stg succeeded