feat(platform): adopt deploy-platform v2

[jorisjonkers-dev-agents]

Onboards auth-api to the deploy-platform rollout.

Platform files added under platform/:

• deployment.yml — v2 contract: namespace auth-system, layer apps-core, health /api/actuator/health/readiness:8081, route auth.jorisjonkers.dev
• images.lock.json — placeholder digest, overwritten on publish
• production.env — non-secret environment values (empty)
• render-local.sh — local CI-parity render script

Workflows added/replaced:

• publish.yml — tag-triggered: build image, lock digest, publish deploy artifact, open homelab-deploy registry PR
• deploy-preview.yml — PR validation on platform/** changes
• release.yml — replaced: mandatory App token (no GITHUB_TOKEN fallback), workflow_dispatch added, publish-image and publish-deploy-bundle removed, publish-api-clients retained

All github-workflows calls pinned to f6c2969d7f1f4555da3b2cf46ce6a9b364c471b3 (v0.12.0).

[github-actions]

Deploy Preview — auth-api

Environments: production
Context ref: ghcr.io/jorisjonkers-dev/cluster-deploy-context-public@sha256:64d00fe03a271dbd03a48005d0a0cc6cc5fe43df23c0e97b649c2f8b3e78b418
Workloads: 1 | Routes: 1 | Gatus entries: 0

Image refs

• auth-api: ghcr.io/jorisjonkers-dev/auth-api/auth-api@sha256:0000000000000000000000000000000000000000000000000000000000000000

SC-11 Readiness Scorecard

	Check	Status
✅	schema_pinned	pass
✅	context_pinned	pass
✅	no_latest_images	pass
✅	health_declared	pass
✅	route_owner_authmode_declared	pass
✅	rollback_retention_acknowledged	pass
❌	no_raw_secrets	fail
➖	stateful_policy_declared	not_applicable
➖	raw_manifests_guarded	not_applicable
❌	npm_signatures_verified	fail

⚠️ Escape hatch in use: one or more scorecard checks are not_applicable.

---

Updated by deploy-preview action on push to this PR.