ci: build.yml → Docker build + ECR push + deploy staging & prod

Push to main (platform code) now:
1. Builds Docker image via Dockerfile.rootless
2. Pushes to ECR (tinqs-git:tag + :latest)
3. Triggers ECS deploy on both tinqs-studio-staging and tinqs-git-prod
4. Archives binary to S3 as backup

Staging and prod deploy from the same image on every push.
release.yml remains for manual rollback/specific version deploys.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.gitea/workflows/build.yml

@@ -1,4 +1,4 @@
-name: Build Platform
+name: Build & Deploy Platform
 
 on:
   push:
@@ -14,6 +14,7 @@ on:
       - 'go.mod'
       - 'go.sum'
       - 'Makefile'
+      - 'Dockerfile*'
       - '.gitea/workflows/build.yml'
     paths-ignore:
       - 'cmd/tstudio/**'
@@ -24,27 +25,77 @@ on:
       - 'SETUP.md'
       - '*.md'
 
+env:
+  AWS_REGION: eu-west-1
+  ECR_REPO: 149751500842.dkr.ecr.eu-west-1.amazonaws.com/tinqs-git
+  ECS_CLUSTER: tinqs-git
+
 jobs:
   build:
     runs-on: host
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
-        with:
-          go-version: '1.26.2'
-      - uses: actions/setup-node@v4
-        with:
-          node-version: '22'
-      - run: npm install -g pnpm
-      - name: Build tinqs-git
-        run: TAGS="bindata sqlite sqlite_unlock_notify" make build
-      - name: Verify binary
-        run: ls -lh gitea && echo "Build successful"
 
-      - name: Upload to S3
+      - name: Set version
+        id: version
         run: |
           SHORT_SHA=$(echo "${GITHUB_SHA:-$(git rev-parse --short HEAD)}" | cut -c1-10)
-          echo "Uploading tinqs-git ($SHORT_SHA) to S3..."
-          aws s3 cp gitea "s3://tinqs-cli-releases/tinqs-git/$SHORT_SHA/tinqs-git"
-          aws s3 cp gitea "s3://tinqs-cli-releases/tinqs-git/latest/tinqs-git"
-          echo "OK tinqs-git ($SHORT_SHA) → s3://tinqs-cli-releases/tinqs-git/"
+          echo "sha=$SHORT_SHA" >> "$GITHUB_OUTPUT"
+          echo "tag=main-$SHORT_SHA" >> "$GITHUB_OUTPUT"
+
+      - name: Login to ECR
+        run: |
+          aws ecr get-login-password --region $AWS_REGION | \
+            docker login --username AWS --password-stdin $ECR_REPO
+
+      - name: Build Docker image
+        run: |
+          TAG="${{ steps.version.outputs.tag }}"
+          docker build \
+            --build-arg GITEA_VERSION="$TAG" \
+            --build-arg TAGS="bindata sqlite sqlite_unlock_notify" \
+            -f Dockerfile.rootless \
+            -t $ECR_REPO:$TAG \
+            -t $ECR_REPO:latest \
+            .
+
+      - name: Push to ECR
+        run: |
+          TAG="${{ steps.version.outputs.tag }}"
+          docker push $ECR_REPO:$TAG
+          docker push $ECR_REPO:latest
+          echo "Pushed $ECR_REPO:$TAG + :latest"
+
+      - name: Deploy to staging
+        run: |
+          aws ecs update-service \
+            --cluster $ECS_CLUSTER \
+            --service tinqs-studio-staging \
+            --force-new-deployment \
+            --region $AWS_REGION \
+            --no-cli-pager
+          echo "Staging deploy triggered"
+
+      - name: Deploy to prod
+        run: |
+          aws ecs update-service \
+            --cluster $ECS_CLUSTER \
+            --service tinqs-git-prod \
+            --force-new-deployment \
+            --region $AWS_REGION \
+            --no-cli-pager
+          echo "Prod deploy triggered"
+
+      - name: Upload binary to S3 (backup)
+        run: |
+          SHORT_SHA="${{ steps.version.outputs.sha }}"
+          # Extract binary from image for S3 archive
+          CONTAINER=$(docker create $ECR_REPO:latest)
+          docker cp $CONTAINER:/usr/local/bin/gitea ./gitea 2>/dev/null || \
+            docker cp $CONTAINER:/app/gitea/gitea ./gitea 2>/dev/null || true
+          docker rm $CONTAINER
+          if [ -f gitea ]; then
+            aws s3 cp gitea "s3://tinqs-cli-releases/tinqs-git/$SHORT_SHA/tinqs-git" --region $AWS_REGION
+            aws s3 cp gitea "s3://tinqs-cli-releases/tinqs-git/latest/tinqs-git" --region $AWS_REGION
+            echo "Binary archived to S3"
+          fi