feat(ci): diff-driven app whitelist for deploy tests

Narrow the test-deploy-{server,universal,workstation} matrix to roles
actually impacted by the branch's diff against origin/main, expanded
transitively over run_after + dependencies + shared services.

Why: full-matrix deploy CI on every PR is wasteful; explicit per-PR
whitelisting is error-prone. The resolver derives the affected set
automatically while remaining fail-safe.

Behaviour (in resolve_effective_whitelist.sh precedence order):
- whitelist input "__ALL__"  -> empty whitelist (force full deploy)
- whitelist input non-empty  -> verbatim
- whitelist input empty      -> diff vs origin/main
  - empty diff or any path outside roles/<role>/   -> __ALL__
  - all paths under roles/<role>/                  -> reverse closure

Fail-safe: any seed that is not modellable in CombinedResolver
(no application_id and not referenced by any role's run_after) and
any resolver runtime error MUST trigger a fall-back to __ALL__.
The closure never silently shrinks the deploy matrix.

test-deploy-local.yml is intentionally exempt (local/manual dispatch
keeps explicit whitelist semantics).

Documented in pipeline.md and workflows.md.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

scripts/github/resolve_effective_whitelist.sh

@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+# scripts/github/resolve_effective_whitelist.sh
+#
+# Resolve the effective WHITELIST that the discover step should pass to
+# scripts/github/output_apps.sh, and write it to GITHUB_OUTPUT.
+#
+# Inputs via env:
+#   INPUT_WHITELIST  caller-provided whitelist (space-separated).
+#                    Three cases, in this order of precedence:
+#                      * "__ALL__" (sentinel, case-insensitive): force
+#                        full deploy across the workflow's scope. Skips
+#                        the diff logic and emits an empty whitelist.
+#                      * any other non-empty value: used verbatim.
+#                      * empty: trigger the diff-based derivation.
+#
+# Output (GITHUB_OUTPUT):
+#   whitelist=<value>  effective whitelist. An empty string means
+#                      "no restriction; deploy everything in scope".
+#
+# Diff logic (only when INPUT_WHITELIST is empty):
+#   1. Run scripts/meta/resolve/diff/affected_roles.sh.
+#   2. If it returns "__ALL__", emit empty whitelist.
+#   3. Otherwise emit the resolved (transitively expanded) role list.
+
+set -euo pipefail
+
+: "${GITHUB_OUTPUT:?Missing GITHUB_OUTPUT}"
+
+input="${INPUT_WHITELIST:-}"
+input_trimmed="${input//[[:space:]]/}"
+
+shopt -s nocasematch
+if [[ "${input_trimmed}" == "__ALL__" ]]; then
+	shopt -u nocasematch
+	printf 'whitelist=\n' >>"${GITHUB_OUTPUT}"
+	echo "Caller forced full deploy via '__ALL__' sentinel."
+	exit 0
+fi
+shopt -u nocasematch
+
+if [[ -n "${input_trimmed}" ]]; then
+	printf 'whitelist=%s\n' "${input}" >>"${GITHUB_OUTPUT}"
+	echo "Using caller-supplied whitelist: ${input}"
+	exit 0
+fi
+
+resolved="$(./scripts/meta/resolve/diff/affected_roles.sh)"
+
+if [[ "${resolved}" == "__ALL__" ]]; then
+	printf 'whitelist=\n' >>"${GITHUB_OUTPUT}"
+	echo "Diff vs origin/main implies full deploy (no whitelist)."
+	exit 0
+fi
+
+printf 'whitelist=%s\n' "${resolved}" >>"${GITHUB_OUTPUT}"
+echo "Diff-derived whitelist: ${resolved}"