Deploy Hypeman staging after merges to main

[sjmiller609]

summary

• trigger a staging deployment after commits land on main
• dispatch the existing kernel/infra Hypeman deploy workflow with the exact merged commit SHA
• use the repository admin app token for cross-repository workflow access

testing

• actionlint .github/workflows/deploy-staging.yml
• git diff --check main...HEAD

---

Note

Medium Risk
Introduces automated staging deploys on every main push and relies on admin app credentials to trigger infra workflows; misconfiguration could deploy wrong refs or fail silently if secrets or infra workflow inputs change.

Overview
Adds a new GitHub Actions workflow that automatically deploys Hypeman to staging whenever commits land on main.

The job mints a GitHub App token (ADMIN_APP_ID / ADMIN_APP_PRIVATE_KEY) scoped to kernel/infra with Actions write permission, then uses gh workflow run to trigger ansible-deploy-hypeman.yml with env=staging, ref set to the pushed commit SHA, and cli-version=latest. Workflow permissions stay minimal (contents: read at the workflow level; cross-repo dispatch uses the app token).

^{Reviewed by Cursor Bugbot for commit efb2337. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit efb2337. Configure here.}