ci: deploy staging to localstack from the pipeline

Summary

Adds deploy:staging (.gitlab/ci/staging.yml): on develop, runner #13 (holapc-staging) builds be and admin from the pipeline's clone, pushes them to LocalStack's ECR (localhost.localstack.cloud:4510), and runs infra/runtime/deploy.sh staging <short sha> — secrets from LocalStack Secrets Manager, migrations, health + public endpoint checks, image rollback on failure.

Replaces the jobs dropped in !74 (merged). Step S11 of the infra plan.

• Needs be:build + admin:build only; resource_group: staging.
• Skips the push when the tag already exists (ECR repos are IMMUTABLE), so a retried job does not fail.
• The shell executor feeds the job script on stdin; nothing in the job reads stdin (docker run without -i, deploy.sh < /dev/null). Without that, the first docker run -i swallowed the rest of the script and the job went green after docker login.

Verification

• Ran the job script by hand on holapc from a clean develop clone (37474e41): built + pushed both images, No migrations are pending, both containers healthy, public endpoints answer; staging now serves 37474e41.
• Tag-exists check: describe-images rc 0 for an existing tag, 254 for a missing one.

After merge

Runner #13 is paused (since !74 (merged)) — unpause it, or this job sits pending.

🤖 Generated with Claude Code