feat(ci): zip and upload generated inventory as a debug artifact

Both deploy workflows now ship the rendered inventory for the matrix
entry as a zip artifact so failed runs can be inspected without
re-running the provisioner. test-deploy-swarm.yml zips /tmp/inv directly;
test-deploy-server.yml docker-cps /root/inventories from every running
infinito_nexus_* container into a staging dir first because the
inventory lives inside the compose container, not on the runner.

Both steps are if: always() to capture artifacts on failure too, but
gated on \!env.ACT because act-local does not provide
ACTIONS_RUNTIME_TOKEN and would otherwise fail the upload step.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

scripts/github/inventory/zip_compose_for_upload.sh

@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+: "${APP_ID:?APP_ID is required (matrix.apps)}"
+
+out="/tmp/inventory-server-${APP_ID}.zip"
+stage="/tmp/inventory-server-${APP_ID}"
+rm -rf "${stage}"
+mkdir -p "${stage}"
+
+mapfile -t containers < <(docker ps --format '{{.Names}}' | grep '^infinito_nexus_' || true)
+for c in "${containers[@]}"; do
+	docker cp "${c}:/root/inventories" "${stage}/${c}-inventories" 2>/dev/null || true
+done
+
+if [[ -d "${stage}" && -n "$(ls -A "${stage}" 2>/dev/null)" ]]; then
+	(cd /tmp && zip -r "${out}" "inventory-server-${APP_ID}")
+else
+	echo "No inventories captured from compose containers"
+fi

scripts/github/inventory/zip_swarm_for_upload.sh

@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+: "${APP_ID:?APP_ID is required (matrix.apps)}"
+
+out="/tmp/inventory-swarm-${APP_ID}.zip"
+if [[ -d /tmp/inv ]]; then
+	(cd /tmp && zip -r "${out}" inv)
+else
+	echo "No inventory found at /tmp/inv"
+fi