OpenConceptLab/ocl_online#451 | Dispatch workflow for the fhir-next staging service

[paynejd]

Adds a manually dispatched workflow that deploys one ref of the FHIR work (OpenConceptLab/ocl_online#451) to a
separate staging service, so the branch can be checked side by side with master on staging. It must be on the
default branch for workflow_dispatch to run, hence this PR; it goes away once the FHIR work merges.

• Inputs: ref (default: the integration branch) and accept_staging_skew.
• Guard: fails if the ref changes migrations/, a documents.py or a tasks.py, or differs from the build staging
  runs in them (unless accept_staging_skew).
• Builds the ref's image and pushes it with a fhir-next-<sha8> tag.
• After the staging environment approval: points fhir-next at that image, redeploys only that service, waits for
  it, and checks /version/ ends in the commit.
• Never touches Docker Hub, the staging or production tags, releases, or any other service. Same secrets and
  login steps as build.yml.

Checked with actionlint 1.7.12: clean apart from the "runner too old" notices build.yml also gets for
actions/checkout@v3 and aws-actions/configure-aws-credentials@v1.

🤖 Generated with Claude Code

https://claude.ai/code/session_019okcdQVD6Kzzdr3gZZBryz

[paynejd]

Codex review, pass 1: findings, 3 findings (P1 1, P2 2). Details on the private tracker.

[paynejd]

Pass 1: the P1 and both P2s are fixed in 137e3ed (a recheck after approval; rename-proof diffs; git failures fail the step). Details on the private tracker.

[paynejd]

Codex review, pass 2: clean, 0 findings; the three pass-1 findings are resolved. Details on the private tracker.

[paynejd]

Simplification review: 4 items; 2 applied in def98b9 (one shared skew-check step via a YAML alias; a shorter served-build check), 2 declined with reasons. Details on the private tracker.

[paynejd]

Codex check of the simplification commit: clean, 0 findings. Details on the private tracker.

[paynejd]

Adversarial pass: 1 P1, 3 P2, 4 P3. Fixed in eef2fff: no Actions cache in the build, a pinned third-party action, run and job names that show the ref and commit, a wait for staging-api before the recheck, and a missing image now fails the step. The P1 (the guard holds at deploy time only) is handled with an operational check outside this repo; three P3s are recorded. Details on the private tracker.

[paynejd]

Codex review, pass 3 (check of the adversarial fixes): clean, 0 findings. Three P3s stay recorded, not fixed. Details on the private tracker.