fix(test-deploy-swarm): actually run the swarm deploy job under act

After the main merge the discover job emits objects ([{apps,variant,variant_slug}]) for the variant matrix, but the swarm workflow still consumed them via the string-form 'matrix: apps:', so matrix.apps became an object, act produced no legs, the deploy job never ran, and act exited 0: every local swarm roundtrip false-passed.

Switch the swarm matrix to 'include:' (matching the compose workflow) so matrix.apps is the app id again, and guard roundtrip.sh to require the 'Matrix-deploy <app> across variant rounds' marker in the log or exit 1, so a skipped deploy can never pass as green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.github/workflows/test-deploy-swarm.yml

@@ -94,7 +94,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        apps: ${{ fromJson(needs.discover.outputs.apps) }}
+        include: ${{ fromJson(needs.discover.outputs.apps) }}
 
     env:
       APP_ID: ${{ matrix.apps }}

scripts/tests/deploy/roundtrip.sh

@@ -48,6 +48,12 @@ for app in "${_apps[@]}"; do
 		swarm)
 			ACT_PLATFORM_IMAGE=local/act-runner-fixed:latest \
 				make -C "$_repo_root" act-swarm-zombie app="$app" 2>&1 | tee "$log"
+			# act exits 0 even when the matrix yields no legs and the swarm deploy job
+			# never ran (only the discover/Lure job), so its clean exit is no proof.
+			grep -q "Matrix-deploy ${app} across variant rounds" "$log" || {
+				echo "roundtrip: ${app} [swarm] FAILED: swarm deploy job did not run (empty matrix); see ${log}" >&2
+				exit 1
+			}
 			# A failure above exits via set -e and leaves the cluster up for inspection;
 			# only a passing run reaches here, so release it unless keep=true.
 			[ "${keep:-false}" = true ] || make -C "$_repo_root" act-swarm-down name="$app"