A failed deploy is silent, so nothing watches production after merge

CI now catches a broken build before merge. Nothing catches a deploy that fails after it — the old container keeps serving, the health check keeps passing, and the only record is a red row in a dashboard nobody has open. That is how twelve days passed unnoticed.