feat(cms): improve catalog, editorial recovery and operations

scripts/ci-deploy.sh

@@ -93,6 +93,7 @@ for managed_name in epicnext-cms epicnext-cms-app; do
 done
 cp "$deploy_dir/.env" .env
 pnpm install --frozen-lockfile
+pnpm exec playwright install chromium
 
 echo "Building $image"
 DOCKER_BUILDKIT=1 docker build --network=host --progress=plain --cache-from epicnext-cms:latest \
@@ -159,8 +160,11 @@ candidate_attempted=1
 )
 healthy
 node scripts/verify-deployed-release.mjs http://127.0.0.1:3002/api/health "$sha"
-# Publish the latest alias only after health and release checks pass.
-docker tag "$image" epicnext-cms:latest
+PLAYWRIGHT_BASE_URL=http://127.0.0.1:3002 pnpm test:e2e
+# Publish the latest alias only after HTTP and browser checks pass.
+verified_image="$(docker inspect --format '{{.Image}}' epicnext-cms-app)"
+docker tag "$verified_image" "epicnext-cms:verified-$sha"
+docker tag "$verified_image" epicnext-cms:latest
 cutover_started=0
 if [ "$backup_created" -eq 1 ]; then docker rm "$backup_name" || true; fi
 if [ "$secondary_backup_created" -eq 1 ]; then docker rm "$secondary_backup" || true; fi
@@ -168,7 +172,7 @@ if [ "$secondary_backup_created" -eq 1 ]; then docker rm "$secondary_backup" ||
 echo "Deployment verified: $sha"
 # Retain the current and previous releases; do not remove arbitrary named tags.
 while IFS= read -r tag; do
-  if [[ "$tag" =~ ^epicnext-cms:[0-9a-f]{40}$ ]] && [ "$tag" != "$image" ]; then
+  if [[ "$tag" =~ ^epicnext-cms:(verified-)?[0-9a-f]{40}$ ]] && [ "$tag" != "$image" ] && [ "$tag" != "epicnext-cms:verified-$sha" ]; then
     tagged_image="$(docker image inspect --format '{{.Id}}' "$tag" 2>/dev/null || true)"
     if [ -n "$tagged_image" ] && [ "$tagged_image" != "$previous_image" ]; then docker image rm "$tag" || true; fi
   fi