fix(ci): isolate staging Actions settings under STG prefix

Map staging Secrets and Variables exclusively from STG names, validate explicit API and SSO settings, and pass them to the staging Worker. Preserve production settings and document the variable registration and Secret migration.

Validation: source checks and 113 tests pass. Gitea STG Variables were created and verified; Secret registration remains with the user.

scripts/deploy-worker.mjs

@@ -1,8 +1,9 @@
 import { spawn } from 'node:child_process';
-import { deploymentOrgSettings } from './org-context-settings.mjs';
+import { stagingSettings } from './staging-settings.mjs';
 
 const worker = 'baron-qa-gateway-test';
 const dryRun = process.argv.includes('--dry-run');
+const validateOnly = process.argv.includes('--validate-only');
 function execute(args, input) {
   return new Promise((resolve, reject) => {
     const child = spawn('npx', ['wrangler', ...args], {
@@ -26,13 +27,16 @@ function execute(args, input) {
   });
 }
 try {
-  const { vars, secrets } = deploymentOrgSettings(process.env);
-  if (!dryRun && Object.keys(secrets).length) await execute(['secret', 'bulk', '--name', worker], JSON.stringify(secrets));
-  const args = ['deploy', '--name', worker];
-  if (dryRun) args.push('--dry-run');
-  for (const [name, value] of Object.entries(vars)) args.push('--var', name + ':' + value);
-  await execute(args);
-} catch {
-  console.error('Worker deployment failed. Check configuration and preceding Wrangler diagnostics.');
+  if (process.argv.slice(2).some((option) => !['--dry-run', '--validate-only'].includes(option))) throw new Error('Unknown staging deployment option');
+  const { vars, secrets } = stagingSettings(process.env);
+  if (!validateOnly) {
+    if (!dryRun && Object.keys(secrets).length) await execute(['secret', 'bulk', '--name', worker], JSON.stringify(secrets));
+    const args = ['deploy', '--config', 'wrangler.toml', '--name', worker];
+    if (dryRun) args.push('--dry-run');
+    for (const [name, value] of Object.entries(vars)) args.push('--var', name + ':' + value);
+    await execute(args);
+  }
+} catch (error) {
+  console.error(error.message || 'Worker deployment failed. Check configuration and preceding Wrangler diagnostics.');
   process.exitCode = 1;
 }