Harden deploy gates, prod AUTH_SECRET, and Sentry error reporting.

Align onlyBuiltDependencies with the workspace, fail fast without AUTH_SECRET in production, and delete catalog_items via VARCHAR-safe SQL so page deletes do not leave orphans.

Co-authored-by: Cursor <[email protected]>

src/lib/deploy-workflow-contract.test.ts

@@ -12,4 +12,26 @@ describe("production deploy workflow", () => {
 		expect(workflow).not.toMatch(/rm\s+-rf[^\n]*\.next/);
 		expect(workflow).toContain("pnpm install --frozen-lockfile");
 	});
+
+	it("does not override onlyBuiltDependencies (uses pnpm-workspace.yaml)", () => {
+		expect(workflow).not.toContain("PNPM_CONFIG_ONLY_BUILT_DEPENDENCIES");
+	});
+
+	it("runs typecheck and tests before build", () => {
+		expect(workflow).toContain("pnpm typecheck");
+		expect(workflow).toContain("pnpm test");
+		const typecheckAt = workflow.indexOf("pnpm typecheck");
+		const testAt = workflow.indexOf("pnpm test");
+		const buildAt = workflow.indexOf("pnpm build");
+		expect(typecheckAt).toBeGreaterThan(-1);
+		expect(testAt).toBeGreaterThan(typecheckAt);
+		expect(buildAt).toBeGreaterThan(testAt);
+	});
+
+	it("exports APP_VERSION from git for Sentry releases", () => {
+		expect(workflow).toContain('export APP_VERSION="$(git rev-parse --short HEAD)"');
+		expect(workflow).toContain(
+			'export NEXT_PUBLIC_APP_VERSION="${APP_VERSION}"',
+		);
+	});
 });