Deploy chain broken: workflow not registered, no safe-deploy script — merged PRs not shipping to mcp.chitty.cc

[chitcommit]

Observed

• `.github/workflows/deploy.yml` exists with `on: push: [main, production]` but does not appear in `gh workflow list` — looks disabled or never registered.
• Last historical runs of deploy.yml (May 2026) both failed.
• No `npm run deploy` script in `package.json`.
• Recently merged PR feat(aggregator): aggregate prompts/resources across bound services #112 (aggregate prompts/resources, Aggregate prompts/resources, not just tools #94) sits on main but is NOT live on mcp.chitty.cc — the live worker is still running prior code.

Likely root cause

Same class as `chittyos/chittyconnect#215` — `CLOUDFLARE_API_TOKEN` GH secret scope insufficient for Workers Scripts + Secrets Store, breaking the workflow registration/run. Possibly compounded by a workflow yaml syntax issue that prevents GHA from registering it.

Impact

Every merged chittymcp PR since whenever the workflow broke (estimate: ~May 2026) is dark — they're in main but not in prod. The 2026-05-27 service inventory used elsewhere (alchemist catalog in ch1tty's focus-suggestions.json) is also stale because the deployed mcp.chitty.cc reflects pre-broken-deploy state.

Resolution

1. Adopt the chittyconnect#217 / chittyentity#324 pattern — `scripts/safe-deploy.sh` + `scripts/audit-bindings.sh` + 15-min binding-drift cron + `package.json` `deploy` script routing through it.
2. Verify GHA workflow registers + runs successfully on the next push to main. Fix the underlying secret scope / yaml issue first (same fix as #215 once it lands for chittyconnect).
3. Once the deploy chain works, redeploy current main to propagate PR feat(aggregator): aggregate prompts/resources across bound services #112 + any other pending merged PRs to mcp.chitty.cc.

ChittyConnect-concierge owns the secret rotation lane (operator-side via the Infrastructure vault, blocked on the same gate as #215/#220/#222).