ci: align deployment gates and release flow with conf-app

[MrCoder]

Summary

Align the web-sequence release lifecycle with conf-app, correcting this PR's earlier immutable-only proposal.

• All repository branches and same-repository PRs may deploy shared staging.
• Default branch and ready-for-review PRs run deployed staging E2E; the required Release validation check waits for that gate.
• Successful master staging E2E creates a timestamp-tagged draft pinned to the tested commit, with Release attachments.
• Manual release/prerelease publication deploys the tag. Prefer the Release frontend attachment; if unavailable, rebuild from the tag with frozen lockfiles. Never install latest dependencies.
• Rollback reuses that attachment-or-rebuild path, including web/dist, functions and rules. Actions artifact expiry does not prohibit recovery.
• Production smoke remains required; production and rollback share a non-cancelling lock.

Reference

ZenUml/conf-app main at fd1b064eedfa0121aead4d1fcf4ae1e7deaf7656: build-test-deploy.yml, staging-deploy.yml, release.yml, wrangler-publish/action.yml.

Platform adaptations: Firebase rather than Cloudflare/Forge, Node 22, separate root/web/functions lockfiles, existing timestamp tag prefix and extension opt-in. Multi-variant scheduling and identical-tree E2E reuse are not copied; master runs its own staging suite. See ADR 0002.

Verification

• node --test scripts/release/*.test.mjs: 5 passed, including missing/empty attachment fallback, valid frontend restoration, backend preservation and corrupt archive failure.
• actionlint 1.7.7: passed.
• bash -n and actual package-extension.sh execution; unzip -t: passed.
• git diff --check: passed.
• Earlier revision: root/web frozen installs and builds, local Chromium 87 passed / 8 skipped; GitHub Release validation passed. These do not substitute for CI on this revision.

Operational state

Master branch protection requires Release validation from GitHub Actions and an up-to-date PR; admin enforcement remains. Production environment allows master and release-* tags without an additional reviewer gate.

No production release or rollback has been executed. The previous quiz's master-only staging and no-rebuild answers described the rejected proposal, not conf-app.