ci(makalu): publish and deploy faucet image

[bachal-mb]

Summary

• publish the Makalu faucet as ghcr.io/kajlabs/lithosphere-faucet
• wait for the immutable faucet SHA image before deployment
• deploy and roll back web, API, indexer, and faucet together via source-controlled protected-host scripts
• fail the public health gate unless /api/faucet/info exposes the MX-02 fail-closed availability schema
• make manual single-service image publishing work for the new faucet matrix entry

Safety and rollout

• This workflow-only merge publishes images but does not trigger deploy-simple.yaml.
• Do not install the new protected-host scripts until the faucet image for the merged commit is published successfully.
• Install the scripts atomically at /opt/lithoscan/ci/ci-deploy.sh and /opt/lithoscan/ci/ci-rollback.sh, preserving backups and validating checksums/Bash syntax.
• Rotate the exposed faucet private key through the server secret path before deploying or funding the faucet.
• Then manually dispatch the gated deployment; retain automatic rollback and verify the public faucet schema.

Validation

• pnpm --dir Makalu/faucet test — 7/7 passed
• pnpm --dir Makalu/faucet build — passed
• Actionlint 1.7.12 — passed
• ShellCheck 0.11.0 — passed
• YAML parsing, Bash syntax, git diff --check — passed

Tracking

Follow-up status remains recorded in #81 / docs/makalu-extra-works-handoff.md.

[github-actions]

Test Results

Package	Passed	Failed	Skipped	Total	Duration
api	no results
indexer	no results
explorer	no results

Coverage

Package	Stmts %	Branch %	Funcs %	Lines %
api	no coverage
indexer	no coverage
explorer	no coverage

_{Generated by ci.yaml for 2b6138f4febcb635b0df1e4ac7be2fe2f84c897a. Test JSON + coverage HTML are uploaded as run artifacts.}

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.