fix(deploy): align Trigger.dev workers with ECS releases - #7698

Summary

An ECS app release can currently run against a different Trigger.dev worker version, and a successful image promotion does not establish that AWS deployed it. Align both sides using the full commit SHA and extend the existing deployment path instead of introducing a release orchestrator or state store.

• Persist runtime COMMIT_SHA in app images and pin worker-originated jobs to the executing worker version. Hosted discovery is enabled by the companion infra change; public images do not enable it themselves.
• Give dev Trigger deployments an external SHA ID; keep staging/production's existing Trigger GitHub integration. Reuse ECR SHA artifacts on retries and promote dev through the existing gated alias mechanism.
• Gate promotion on the matching worker, all images, and exact current branch head. Verify the ECR source digest, CodePipeline execution, CodeDeploy result, primary ECS task set, and running app image; record complete/incomplete/superseded outcomes.
• Preserve existing migrations and rollback controls. This aligns versions and makes retries safe; it does not promise simultaneous deployment across providers.

Companion drafts: hosted infra configuration and runbook, dev duplicate-trigger cleanup.

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation
• Other

Testing

• 300 root-script tests pass, including nine focused verifier tests covering identity, stale releases, retries, failures, rollback, timeouts, and index/platform digests.
• Seven runtime-helper tests pass, including two additions for worker-version pinning and local-development behavior.
• Monorepo lint and type checks, 46 repository audits, standalone verifier type-check, actionlint, and diff checks pass.
• Read-only smoke check successfully matched a known staging Trigger deployment through GitHub metadata.

No YAML snapshots or duplicate queue/secret-loader tests were added. No deployments were executed. The non-production release/repeat/partial-failure/stale-release/rollback exercise remains pending.

Rollout prerequisites

Keep the change in draft until live AWS/Trigger metadata and configuration are verified. Before enabling hosted pinning, establish the app/worker SHA baseline, confirm producer mappings and retained worker/image versions, and resolve any configuration that overrides SHA discovery. CI needs metadata-read permissions and a 5400-second AWS role session. IAM/ECR policy ownership and live drift remain unverified; secret synchronization belongs to its separate investigation. The companion infra README contains rollout and recovery instructions.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)