Removes standalone deploy-promote.yml and adds two manual jobs
(promote-changelog, promote-create-pr) to the existing Continuous
workflow via workflow_dispatch. Supports preprod and prod targets
with auto-changelog and Slack notifications.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

- Fix concurrency group to avoid cancelling promote jobs on concurrent pushes
- Guard jest-tests from running on workflow_dispatch events
- Fix PR body heredoc indentation that broke markdown rendering

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Two manual jobs now appear in every push-to-master workflow run:
- "Promote: master → preprod" (gated by promote-preprod environment)
- "Promote: preprod → prod" (gated by promote-prod environment)

Developers click "Review deployments" in the Actions UI to approve.
Each job generates a changelog and creates a PR automatically.
Prod promotions also post to Slack.

Requires creating "promote-preprod" and "promote-prod" environments
in repo Settings → Environments with required reviewers.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Promotion jobs belong in deploy-static.yaml since that's the workflow
that runs on push to master/preprod/prod. After the staging deploy
completes (detect → release → update-state → trigger-deploy),
two environment-gated jobs appear:

  - "Promote: master → preprod" (gated by promote-preprod env)
  - "Promote: preprod → prod" (gated by promote-prod env)

Developers click "Review deployments" to approve, then the job
creates a PR with auto-generated changelog. Prod also sends Slack.

Reverts continuous.yaml to its original state.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Adds a branch-protection job that runs before detect and enforces:
- preprod: only accepts merges from master
- prod: only accepts merges from preprod, unless the actor is in
  the HOTFIX_ALLOWED_USERS secret (comma-separated usernames)
- master: no restriction
- [skip ci] deploy state commits are always allowed

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Moves branch protection from deploy-static (post-push, too late) to
a separate promotion-gate.yaml that runs on PRs targeting preprod/prod.

Rules:
  - preprod: only accepts PRs from master
  - prod: only accepts PRs from preprod (or hotfix users)

This should be set as a required status check in GitHub branch protection
for preprod and prod branches — prevents the merge button from being
available when the source branch is wrong.

Hotfix users are configured via HOTFIX_ALLOWED_USERS secret
(comma-separated GitHub usernames).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Updates promotion gate per team feedback:
- preprod accepts: master, hotfix/*
- prod accepts: preprod, hotfix/*
- Removed per-user hotfix check (HOTFIX_ALLOWED_USERS) — who can
  approve is controlled by GitHub environment reviewers instead

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

- Extract changelog + PR creation to build/ci/generate-promotion-pr.sh
  (DRYs up the two promote jobs in deploy-static.yaml)
- Handle empty commits: skips PR creation when branches are identical
- Add merge_group trigger to promotion-gate.yaml for merge queue support
- Slack notification now also skips on no-changes

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>