[Operations] Prove deployment provenance and isolate Cloudflare environments

[jongan69]

Outcome

Make relay development, staging, and production independently deployable, auditable, recoverable, and gated through their matching GitHub environments.

Current state

The live NIP-11 endpoint responds with protocol 0.1 and advertises all seven implemented service roles. That does not prove its Worker SHA or migration state matches protected main. wrangler.toml still describes one first-party resource set. GitHub staging and reviewer-gated production environments exist, but deployment workflows do not yet consume them.

Acceptance checklist

• Inventory the live Worker version/SHA, D1 migrations, Durable Object migration, R2, KV, Queue, AI, domains, and secret names
• Create distinct development, staging, and production Worker/D1/R2/KV/Queue resources and secrets
• Add environment-specific Wrangler configuration without copying production identifiers into staging
• Add protected deployment workflows using the GitHub staging and production environments
• Fail release validation when any required service signer, Queue, AI, media, moderation, or deletion dependency is absent
• Record artifact checksum, source SHA, migrations, deploy ID, approver, and rollback command for every production deployment
• Configure encrypted backups and complete a restore/rollback drill
• Verify health, service capabilities, queue age, deletion, moderation, storage growth, and alerts after deployment

Non-goal

Do not deploy or rotate production keys merely to close this issue; those actions require an approved migration and rollback plan.