Make staging and production deployment hosts independent

[ostomachion]

Summary

Make staging and production independent deployment targets while retaining today's shared-server layout as explicit configuration. This is a small host-profile interface, not a new hosting/orchestration system.

• Require an environment-scoped EDGE_PROFILE: shared, staging, or production, with no implicit default.
• Render only the selected host's Caddy sites and web mounts; preserve host-local Compose/network/certificate-volume names and reviewed image pins.
• Select the edge workflow's credential environment explicitly. Shared edges remain production-controlled; changing an installed profile requires a separate production approval, allowing either environment to move first without repointing the other environment's credentials.
• Check installed host profiles before transferring app releases. Only shared staging deployments check production availability.
• Probe edge readiness over pinned SSH against that host's loopback HTTPS, without external proxies, TLS bypass, redirects, or a dependency on an already installed application.
• Cover wrong-host rejection, bootstrap directory ownership, legacy shared adoption, symmetric migration/rollback, and per-environment SSH setup in tests/docs.

Required before merge

In GitHub Settings > Environments, set EDGE_PROFILE=shared in both staging and production. Keep existing SSH secrets and verified host-key variables. A merge triggers the normal staging workflow, which now fails closed if the profile is absent.

After merge, when ready for a deliberate infrastructure update, dispatch CD Edge from main, select production, and leave allow-profile-change off. This adopts the existing shared layout and marks it explicitly. Follow docs/setup/hosting.md; the change does not migrate servers or data.

Validation

• dotnet restore, format verification, Release build: passed; build has 0 warnings and 0 errors.
• Solution tests: 72 passed, 0 failed/skipped.
• Release-script, application rollback, edge deployment, topology, and supply-chain suites: passed.
• Real Docker Compose rendering of all three profiles: passed without a Docker daemon.
• Pinned Caddy image fmt --diff and validate for all three profiles: passed without formatting warnings, using temporary local containers with no network or published ports.
• Changed YAML parsing, embedded Bash syntax checks, and diff whitespace checks: passed.
• Independent review identified the reverse migration gap; fixed and re-reviewed with no remaining actionable findings.

No remote deployment, release, SSH credential/configuration change, DNS change, or host migration was performed. Separate-host live acceptance remains an operator step after an authorized cutover.

Older patch branches retain the existing infrastructure-backport requirement: before deploying a branch cut from an older tag, include the compatible workflows/shared validation action, profile helpers, edge templates, and topology tests in its preparation PR. Prepare Patch does not automatically backport this infrastructure baseline.

AI assistance

This implementation and its regression tests were agent-authored, reviewed, and locally validated. Maintainer review is still required before merge.