feat: deploy Cloudflare production from master

[HazAT]

Summary

• deploy Cloudflare production automatically on every push to master
• run the full reusable verification workflow before applying D1 migrations and deploying the Worker/static assets
• retain a safe manual retry path that can only deploy master
• document the production workflow and required GitHub Actions secrets

Repository setup

• CLOUDFLARE_ACCOUNT_ID is configured for the Sentry Production account
• CLOUDFLARE_API_TOKEN must be added before this PR is merged; it should be account-scoped with Edit Cloudflare Workers and D1 Edit permissions

This PR is a draft until the API token secret is configured, because merging it will immediately start the first production deployment.

Verification

• actionlint .github/workflows/deploy.yml .github/workflows/test.yml
• npm run verify
  • typecheck, formatting, and lint passed
  • 114 automated tests passed
  • production build and Cloudflare deploy dry run passed
  • all six D1 migrations and 22 local readiness checks passed

[HazAT]

Superseded by #138, which includes this automatic master deployment workflow and documentation updated for the Sentry Internal Cloudflare account.