feat(etl): weekly digest producer — @sigma/report extraction + Monday cron (#167A)

.github/workflows/deploy.yml

@@ -115,6 +115,19 @@ jobs:
       # fails open. wrangler-render stamps this into ENVIRONMENT. Not derived from import.meta.env.PROD,
       # which Vite inlines true for the staging build too (it would misclassify staging as production).
       SIGMA_ENVIRONMENT: ${{ vars.SIGMA_ENVIRONMENT }}
+      # AI-Gateway account id in AI_GATEWAY_BASE_URL (and web's BGGPT_STT_BASE_URL). wrangler-render swaps
+      # the committed prod account for this env's own — dev/staging run on a different Cloudflare account
+      # whose `sigma-assistant` gateway + `custom-bggpt` provider live there. Unset (prod) → committed
+      # account stays. Without this, a non-prod deploy calls the PROD gateway, which this env's key can't
+      # use, so every BgGPT call (web assistant + etl digest narrative) fails. preview.yml already passes
+      # this; deploy.yml was missing it, so the dev etl/web workers kept the prod URL.
+      SIGMA_AI_GATEWAY_ACCOUNT: ${{ vars.SIGMA_AI_GATEWAY_ACCOUNT }}
+      # Turnstile SITE key (public, domain-bound), per-environment. wrangler-render stamps this over the
+      # committed prod key; unset (prod) → committed key stays. Without it the swap is a no-op and the
+      # prod (domain-bound) site key ships to dev/staging too, so the moment SIGMA_ASSISTANT_ENABLED=true
+      # there, the bot-gate (useTurnstileGate) fails to validate on the non-prod domain. Same missing-var
+      # class as SIGMA_AI_GATEWAY_ACCOUNT above.
+      SIGMA_TURNSTILE_SITE_KEY: ${{ vars.SIGMA_TURNSTILE_SITE_KEY }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10