Deploy jobs use GitHub environments

[byteful]

What changed

The web, iOS, Android and shared-package publish jobs now run inside the GitHub staging / production environments. A production build waits for approval by a release reviewer and can only run from main or a release tag. No app changes.

Before you start

• Where: GitHub → civfix-app → Actions, right after this merges to main; then civfix.dev
• Related PRs: Deploy jobs use GitHub environments civfix-admin#51, Deploy jobs use GitHub environments civfix-backend#131, https://github.com/civfix/dev-env/pull/22

Verify

[Web]

1. Open the "Deploy web (Cloudflare Pages)" run started by the merge — Expect: the deploy job shows the environment "staging", starts without waiting for anyone, and finishes green.
2. Open civfix.dev and pan the map — Expect: the site loads and pins appear as before.
3. In Actions, open "Deploy web (Cloudflare Pages)" → "Run workflow", pick any branch other than main, run it — Expect: the job is refused before any step runs, with a message that the branch is not allowed to deploy to "staging".

[Mobile]

1. Open the "Deploy mobile (TestFlight)" run started by the merge — Expect: the iOS job shows "staging", runs without waiting, and a new build reaches TestFlight.
2. Open the "Deploy mobile (Android)" run started by the merge — Expect: the Android job shows "staging", runs without waiting, and a new build reaches the Play internal track.

Regression

Publishing the shared package — [none]

1. On the next merge that carries a contract version bump, open the "publish @civfix/shared" run — Expect: it runs in "staging" without waiting and publishes as before.

Branch snapshots — [none]

1. Run "publish @civfix/shared snapshot" on a feature branch — Expect: unchanged: it runs with no environment and no approval.

Production release — [Web] [Mobile]

1. At the next release, open the release run of "Deploy web (Cloudflare Pages)" — Expect: it shows "Waiting" for review in "production"; after approval it deploys civfix.org.
2. Start a production iOS or Android build from the release script — Expect: the same "Waiting" for "production", then the store upload after approval.

Not covered

• The production approval itself until the next release.
• Workflows on release tags cut before this merge have no environment; their secrets are still repo/org-level by decision, so those old tags are not gated.