Fix deploy-production: fail fast with clear error when Render deploy hook secrets are missing

[Copilot]

The deploy-production job was failing with curl: (3) URL rejected: Malformed input to a URL function because RENDER_SITE_DEPLOY_HOOK and RENDER_API_DEPLOY_HOOK secrets were not set in the production environment — GitHub silently substitutes "" for unset secrets, passing an empty URL to curl.

Changes

• Validate secrets before use — explicit emptiness checks fail the job immediately with a descriptive ::error:: message pointing to the missing secret name, rather than a cryptic curl error
• Pass secrets via env: block — avoids interpolating secret values directly into the shell command (security best practice; keeps values out of the expanded command string)

- name: Deploy to production
  env:
    RENDER_SITE_DEPLOY_HOOK: ${{ secrets.RENDER_SITE_DEPLOY_HOOK }}
    RENDER_API_DEPLOY_HOOK: ${{ secrets.RENDER_API_DEPLOY_HOOK }}
  run: |
    if [ -z "$RENDER_SITE_DEPLOY_HOOK" ]; then
      echo "::error::RENDER_SITE_DEPLOY_HOOK secret is not set. Configure it in the production environment."
      exit 1
    fi
    ...
    curl -fsS -X POST "$RENDER_SITE_DEPLOY_HOOK"

Required action: Add RENDER_SITE_DEPLOY_HOOK and RENDER_API_DEPLOY_HOOK to the production environment secrets in Settings → Environments → production.