ci: test on v* tags, optional self-hosted staging deploy on betas

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.github/actionlint.yaml

@@ -0,0 +1,6 @@
+self-hosted-runner:
+  # Custom self-hosted runner label for the internal staging host (.165).
+  # The runner is not wired up yet; the deploy-staging job is gated behind
+  # the STAGING_ENABLED repo variable until it is.
+  labels:
+    - clusev-staging

.github/workflows/ci-staging.yml

@@ -0,0 +1,42 @@
+name: CI + staging
+on:
+  push:
+    tags: ['v*']
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: shivammathur/setup-php@v2
+        with:
+          php-version: '8.3'
+          coverage: none
+      - run: composer install --no-interaction --prefer-dist --no-progress
+      - run: cp .env.example .env && php artisan key:generate
+      - run: php artisan test
+      - run: ./vendor/bin/pint --test
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+      - run: npm ci
+      - run: npm run build
+      - name: shellcheck
+        run: |
+          docker run --rm -v "$PWD:/mnt" -w /mnt koalaman/shellcheck:stable \
+            docker/wg/clusev-wg.sh install.sh update.sh scripts/*.sh
+
+  deploy-staging:
+    needs: test
+    # Only beta tags, and only when a self-hosted internal runner is wired up.
+    if: ${{ contains(github.ref_name, '-beta') && vars.STAGING_ENABLED == 'true' }}
+    runs-on: [self-hosted, clusev-staging]
+    environment: staging
+    steps:
+      - name: Update the staging stack
+        run: |
+          cd "${{ vars.STAGING_PROJECT_DIR }}"
+          sudo ./update.sh