Add staging-debug release-train workflow, validation helpers, docs, and tests

[ranade-oss]

Motivation

• Provide a reproducible, run-scoped staging-only release-train debug workflow that can inject and verify a real failure without touching production or enabling promotion.
• Ensure staging debug runs use isolated data and app names and fail fast if any production overlap or missing staging resources is detected.

Description

• Add a new GitHub Actions workflow .github/workflows/staging-debug-release-train.yml that provisions ephemeral Fly apps, builds candidate images, deploys worker/API/web, injects a deliberate web failure, verifies rollback, collects diagnostics, destroys ephemeral apps, and uploads artifacts, while containing no production promotion steps.
• Add documentation docs/staging-debug-release-train.md describing usage, required staging secrets, and safety constraints.
• Add validation library scripts/lib/staging-debug.mjs and a runner scripts/validate-staging-debug.mjs to generate run-scoped app names and assert isolation from production resources.
• Add baseline tests tests/baseline/ross-staging-debug.test.mjs that exercise name generation, isolation checks, and assert key workflow properties (diagnostics, cleanup, no promotion).

Testing

• Executed the new baseline tests in tests/baseline/ross-staging-debug.test.mjs using the repository test runner (node --test / npm test), and the assertions regarding name generation, resource isolation, and workflow contents passed.

---

Codex Task