fix: dispatch production deploys from main

docs/design/environments-and-delivery.md

@@ -99,6 +99,7 @@ Project ID、region、zone、VM 名、Artifact Registry 名、公钥、short ID
 
 - 触发：`workflow_dispatch`。
 - 输入：`environment` 与 `git_ref`；production 的 `git_ref` 必须解析为 `main` 可达 commit。
+- 本地 `make deploy ENV=production` 固定从 `main` 版本的 workflow dispatch；development 保持当前分支作为 workflow ref。
 - 构建 subscription 镜像并以 commit SHA 标记，推送后只使用 registry 返回的 digest。
 - 顺序：验证输入 → 发布 proxy VM → 创建无流量 Cloud Run revision 并等待 startup probe → 按不可变 revision name 切流 → 公网 health/订阅复验 → 真实双协议 E2E。
 - 使用 `github-deploy`；不得创建或修改 OpenTofu 拥有的网络、IAM、VM 或 secret 容器。

scripts/github/dispatch-deploy.sh

@@ -7,5 +7,9 @@ case "$environment" in development|production) ;; *) printf '%s\n' 'ENV must be
 command -v gh >/dev/null 2>&1 || { printf '%s\n' 'missing command: gh' >&2; exit 1; }
 [[ -n "$git_ref" ]] || git_ref="$(git rev-parse HEAD)"
 workflow_ref="$(git symbolic-ref --quiet --short HEAD || printf '%s' main)"
+if [[ "$environment" == production ]]; then
+  workflow_ref="main"
+  [[ -n "${GIT_REF:-}" ]] || git_ref="main"
+fi
 gh workflow run deploy.yml --ref "$workflow_ref" -f "environment=${environment}" -f "git_ref=${git_ref}"
 printf 'deploy workflow dispatched for %s at %s\n' "$environment" "$git_ref"

scripts/github/test-tools.sh

@@ -100,4 +100,12 @@ PATH="${fake_bin}:$PATH" FAKE_COMMAND_LOG="$command_log" \
 status=$?
 set -e
 [[ "$status" -ne 0 ]] || { printf '%s\n' 'reset accepted production' >&2; exit 1; }
+
+: >"$command_log"
+PATH="${fake_bin}:$PATH" FAKE_COMMAND_LOG="$command_log" ENV=production GIT_REF=release-sha \
+  "$script_dir/dispatch-deploy.sh" >"${test_root}/dispatch-production.log"
+rg -q 'gh workflow run deploy.yml --ref main -f environment=production -f git_ref=release-sha' "$command_log" || {
+  printf '%s\n' 'production deploy dispatch did not select the main workflow ref' >&2
+  exit 1
+}
 printf '%s\n' 'GitHub tool isolation tests passed'