fix(ci): align deploy workflow with project toolchain and fix failing tests

[otobongdev]

Summary

This PR fixes the SEV-1 production deploy failure by correcting the CI
deploy workflow to match the project's actual toolchain (Node 22 + Yarn 4
via Corepack) and resolves test failures across the frontend and API
test suites.

Problem

The deploy-frontend job in .github/workflows/deploy.yml used Node 18
and npm (npm ci, npm run build), but the project requires Node 22+
and Yarn 4 (Corepack). This caused the production deploy to fail at
SHA 90c0049 with no recoverable last-known-good artifact.

Separately, multiple test files had accumulated failures from recent
merges (invalid CSP assertions, vi.mock hoisting issues, missing mocks,
Zod validation mismatches, BigInt serialization, etc.), causing CI to
fail on subsequent pushes.

Changes

Deploy workflow (.github/workflows/deploy.yml)

• Upgrade actions/checkout from v4 to v7 across all jobs
• Add corepack enable step before Node setup
• Switch Node version from 18.x to 22
• Replace npm ci with yarn install --immutable
• Replace npm run build with yarn build
• Add yarn check:setup --warn-only validation step
• Fix SBOM generation to mkdir -p sbom before writes
• Upgrade actions/attest-build-provenance from v2 to v4
• Simplify create-release job to avoid missing artifact references
• Fix frontend/wasm checksum artifact paths to include .sha256 files
• Fix cargo cache paths (remove escaped tildes/parens)

Typecheck fixes (4 files)

• Fix duplicate BookOpenCheck import in BuyerLibrary.tsx
• Fix missing autoLockSecondsLeft/extendSession in WalletProvider initialState
• Add missing formatXLM import in history/page.tsx
• Remove duplicate giftPrompt method in promptHashClient.ts

Test fixes (18 files)

• Fix CSP header assertion in wrapper.test.ts
• Fix vi.mock hoisting in api/sitemap.test.ts using vi.hoisted()
• Fix sitemap.ts to read APP_URL inside handler (not module scope)
• Fix CAPTCHA threshold in unlock lockout tests
• Fix normalizeContentHash null safety for legacy prompts
• Add redisClient mock to unlock and challenge tests
• Add CartProvider to test renderWithProviders wrapper
• Fix PurchaseButton.test.tsx — add missing pagination mock, fix error message
• Fix unlock.test.ts — use valid Stellar public keys for Zod validation
• Fix StellarAddressInput.test.tsx — use stateful wrapper for controlled input testing
• Fix checkout.test.ts — add missing classifyContractError and formatContractErrorMessage mocks
• Fix reviewListAndModeration.test.ts — add headers to request mock, add setHeader to response
• Fix marketplaceReadCache.ts — add BigInt serializer for JSON.stringify
• Fix PromptCard.test.tsx — update price label assertion for new CurrencyPrice component

Test Results

• Build: ✅ passes
• Lint: ✅ 0 errors (187 pre-existing warnings)
• Tests: 877 passed / 9 failed (all 9 failures are pre-existing and unrelated to this fix)

The 6 remaining failing test files (WalletProvider session persistence, integration tests, network state tests) were already failing on main before this fix and involve complex mock setup issues unrelated to the deploy failure.

Verification

• yarn lint passes (0 errors)
• yarn build succeeds
• yarn test:frontend — 877/886 pass
• Deploy workflow uses correct toolchain (Node 22, Yarn, Corepack)

Incident Timeline

Time (UTC)	Event
2026-08-31 07:50	Merge PR #561 (route error boundaries) to main
2026-08-31 ~08:00	Deploy workflow triggered, fails (Node 18 + npm mismatch)
2026-08-31 ~08:01	Rollback automation detects failure, opens SEV-1 incident
2026-09-02 ~14:00	This PR created to fix deploy workflow and test failures

Related

• Incident: SEV-1 automated rollback
• Root cause: deploy.yml used npm/Node 18 instead of Yarn/Node 22