Move the deploy pipelines' multi-line steps into tested scripts

[anth-volk]

Fixes #761

Same-Repository Draft PR Check

• This PR is a draft.
• This PR is from a branch in PolicyEngine/policyengine-sim-api, not a personal fork.

Summary

Phase 1 step 1.7, part 2: the production deploy pipelines (simulation-deploy.reusable.yml, simulation-deploy.yml). Stacked on the part 1 PR.

Every multi-line block that predates #743 and #744 is fixed. Those two PRs merged to main after this one was written; see After rebasing onto #743 and #744 below.

Moved into tested scripts:

Step	Script
Capture stable service state	cloud-run-simulation-entry-stable-state.sh
Resolve exact candidate metadata	cloud-run-simulation-entry-candidate.sh
Select the v2 application name	stage12-v2-application-name.sh
Validate v2 workers	stage12-validate-v2-workers.sh
Stage 12 result check	stage12-deployment-ready.sh
Deployment result check	simulation-deployment-ready.sh

Other changes:

• Build and push the entrypoint image are now separate steps. If the build fails, the push is still skipped.
• Four backslash-continued commands are now single lines.
• The executor app name is a one-line echo.
• Fixed after review: the stage12_v2_ready and deployment_ready jobs now check out the repository before running their scripts. Without the checkout, both gates would have failed every deployment. A test checks that every job running a repository script checks it out first.

Behaviour is unchanged, apart from the checkout fix above. A PyYAML comparison of the old and new workflows shows identical job if/needs/env/outputs/permissions/environment and identical step id/if/working-directory. The only env: change adds ENTRYPOINT_SERVICE: ${{ inputs.entrypoint_service }} to the two Cloud Run steps. Each script body equals the old inline code, with ${{ inputs.* }} replaced by a variable.

Points to review:

• The scripts add set -u; every variable they read comes from env: or the runner.
• The v2-validation script now rejects an empty Modal environment. That input is required, so this can't happen in practice.
• Two scripts keep #!/bin/bash, because an existing executor test requires it for modal-*/simulation-* scripts.

After rebasing onto #743 and #744:

• Gate releases on a numerical sentinel and make them reversible #744 replaced the "Publish active routing state" step with journaled plan, record, publish and finalize steps, so this PR no longer adds modal-publish-routing.sh or its tests.
• Gate releases on a numerical sentinel and make them reversible #744's new readiness checks (routing result, finalizer result and outcome) moved into simulation-deployment-ready.sh, with tests. Two of Gate releases on a numerical sentinel and make them reversible #744's gate tests now run from the repository root.
• Expose the certified dataset SHA-256 and assert the served identity at deploy #743 and Gate releases on a numerical sentinel and make them reversible #744 added 13 multi-line run: blocks of their own: 7 in simulation-deploy.reusable.yml (sentinel checks and the routing steps) and 6 in simulation-rollback.yml. Their tests read the steps' inline shell from the workflow YAML, so moving them means rewriting those tests. That's left to a follow-up PR. Until then, the 13 stay in rules/baselines/ci-multiline-run.txt, and sim.ci.multiline-run-is-script stays ratcheted: the baseline can only shrink, so no new multi-line block can be added.

Testing

• New tests/test_deploy_workflow_scripts.py: 40 tests using fake gcloud/uv and the real jq. They assert exact arguments, the full $GITHUB_OUTPUT text and exit codes, including failure paths and every combination of job results.
• Entry tests: 444 pass, including Expose the certified dataset SHA-256 and assert the served identity at deploy #743's and Gate releases on a numerical sentinel and make them reversible #744's. Executor test_modal_scripts.py: 60 pass, or 77 including the manifest and package-update tests.
• Both guards pass, and guard --base-ref ci-scripts-exceptions passes.
• actionlint is clean on all workflows, and all scripts are executable.

🤖 Generated with Claude Code