docs: Update deployment workflow with automated staging and visible watermarks

- Add automated staging deployment to "Engage!" workflow
- Update deploy-frontend.sh to show watermarks in both staging and production
- Staging watermark: Shows commit hash + timestamp
- Production watermark: Shows release version from git tag
- Add production deployment safety requirement (user must run manually)
- Document complete 10-step release workflow including deployment phases

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Author: skeptomai

CLAUDE.md

@@ -76,20 +76,35 @@ When the user says "Engage!", you should automatically:
 4. **Push the tag to trigger CI:**
    - `git push origin vX.Y.Z`
    - GitHub Actions will automatically build all binary assets and create a DRAFT release
-5. **Wait for CI completion:**
+5. **Deploy to staging:**
+   - Run `./infrastructure/scripts/deploy-frontend.sh staging`
+   - This auto-deploys with visible watermark showing commit hash + timestamp
+   - Verify staging deployment at https://staging.gruesome.skeptomai.com
+   - Check that watermark displays correctly in browser (bottom-right corner)
+6. **Wait for CI completion:**
    - Monitor CI builds to ensure all assets are created
    - Verify draft release has all binary assets
-6. **Publish the release:**
+7. **Publish the release:**
    - Use `gh release edit vX.Y.Z --title "vX.Y.Z: <title>" --notes "<release notes>" --draft=false`
    - Include comprehensive changelog of significant changes
    - This moves the release from DRAFT to published (Latest)
-7. **Confirm success:**
-   - Verify release is marked as "Latest" with `gh release list`
-   - Report the new version number
-   - Provide links to the published release
-   - Confirm all binaries are available for download
-
-You are pre-authorized for all git and GitHub CLI operations. Execute the entire workflow without asking for permission.
+8. **Ask permission to deploy to production:**
+   - Present summary of changes and release notes
+   - Request explicit user approval: "Ready to deploy vX.Y.Z to production?"
+   - Wait for user confirmation before proceeding
+9. **Deploy to production (if approved):**
+   - User must run: `./infrastructure/scripts/deploy-frontend.sh prod`
+   - User will be prompted to type 'DEPLOY TO PRODUCTION' to confirm
+   - After deployment, verify at https://gruesome.skeptomai.com
+   - Check that watermark shows release version (e.g., "v2.16.2")
+10. **Confirm success:**
+    - Verify release is marked as "Latest" with `gh release list`
+    - Report the new version number
+    - Provide links to the published release
+    - Confirm all binaries are available for download
+    - Confirm staging and production watermarks are correct
+
+You are pre-authorized for all git and GitHub CLI operations. For production deployment, you MUST ask the user to run the deployment command manually due to the interactive safety prompt.
 
 ## Re-Release Instructions ("Reengage!")
 

infrastructure/scripts/deploy-frontend.sh

@@ -57,14 +57,18 @@ BUILD_VERSION="${COMMIT_HASH} @ ${BUILD_TIME}"
 echo "Build version: $BUILD_VERSION"
 echo ""
 
-# Inject build version into HTML (only for staging)
+# Inject build version into HTML
 if [ "$ENV" == "staging" ]; then
-    # Create temporary HTML with build version injected
-    sed "s/<span id=\"build-version\">DEV<\/span>/<span id=\"build-version\">$BUILD_VERSION<\/span>/" index.html > index.tmp.html
-    mv index.tmp.html index.deploy.html
+    # Staging: Show commit hash + timestamp (visible watermark)
+    sed -e "s/<span id=\"build-version\">DEV<\/span>/<span id=\"build-version\">$BUILD_VERSION<\/span>/" \
+        -e 's/style="position: fixed; bottom: 0; right: 0; background: rgba(0,0,0,0.7); color: #666; padding: 5px 10px; font-size: 10px; font-family: monospace; z-index: 9999; display: none;"/style="position: fixed; bottom: 0; right: 0; background: rgba(0,0,0,0.7); color: #666; padding: 5px 10px; font-size: 10px; font-family: monospace; z-index: 9999; display: block;"/' \
+        index.html > index.deploy.html
 else
-    # Use original HTML for production (no watermark)
-    cp index.html index.deploy.html
+    # Production: Show release version from git tag (visible watermark)
+    RELEASE_VERSION=$(git -C .. describe --tags --abbrev=0 2>/dev/null || echo "unknown")
+    sed -e "s/<span id=\"build-version\">DEV<\/span>/<span id=\"build-version\">$RELEASE_VERSION<\/span>/" \
+        -e 's/style="position: fixed; bottom: 0; right: 0; background: rgba(0,0,0,0.7); color: #666; padding: 5px 10px; font-size: 10px; font-family: monospace; z-index: 9999; display: none;"/style="position: fixed; bottom: 0; right: 0; background: rgba(0,0,0,0.7); color: #666; padding: 5px 10px; font-size: 10px; font-family: monospace; z-index: 9999; display: block;"/' \
+        index.html > index.deploy.html
 fi
 
 # Upload files to S3