fix: harden GHCR deployment security and logging

[sprahasingh]

No description provided.

[codelens-gh]

CodeLens Pre-Review Analysis

Outcome: Incomplete; an external service prevented full analysis

15 hunks scanned · 17 similar past patterns found

The review is incomplete because Groq synthesis did not complete. No conclusion about the presence or absence of defects was reached.

---

---

Generated by CodeLens. Historically grounded findings cite their source reviews; general analysis is labeled separately.

General change overview (not historical evidence)

Changed areas (3 files; +426/-43 lines):

• docs/ghcr-deployment.md (+14/-9)
• scripts/deploy_ghcr.sh (+120/-34)
• tests/test_deploy_ghcr_security.py (+292/-0)
  Test files changed: tests/test_deploy_ghcr_security.py

Analysis status: Groq synthesis failed after its bounded retries. This review is incomplete; no no-findings conclusion was reached.

Note: This analysis is partial. Review the analysis status above for the reason and the scope that was not completed.