Add GitHub Actions Cloud Run deploy path

[Pigbibi]

Summary

• add a Dockerfile so GitHub Actions can build a deployable Cloud Run image
• add an opt-in ENABLE_GITHUB_CLOUD_RUN_DEPLOY path alongside the existing env sync path
• derive Artifact Registry hostname from CLOUD_RUN_REGION unless explicitly configured, which keeps HK/SG deployments region-aware

Validation

• git diff --check
• npx prettier --check parsed the workflow; it reported formatting warnings only, so I did not rewrite the whole workflow

Rollout

• leave existing Cloud Build triggers enabled until one GitHub Actions deploy is verified
• then set ENABLE_GITHUB_CLOUD_RUN_DEPLOY=true per GitHub Environment and disable the old triggers

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 49b6c677a5

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Put the commit label where the wait step reads it

When ENABLE_GITHUB_CLOUD_RUN_DEPLOY=true and ENABLE_GITHUB_ENV_SYNC=true, this deploy writes commit-sha with gcloud run deploy --labels, but the next step waits on spec.template.metadata.labels.commit-sha. Cloud Run documents --labels as service metadata labels, while revision labels live under spec.template.metadata.labels (see https://cloud.google.com/run/docs/configuring/services/labels), so the wait loop never sees the SHA from this deploy and times out before syncing env vars. Either query the service metadata label here or set the label on the revision template before the wait.

Useful? React with 👍 / 👎.