Automate production deployment after releases

[yaojin3616]

Summary

• chain successful GitHub Releases into a production deployment job
• fetch and check out the exact release tag on the existing production server checkout
• build and restart Clawith from source with Docker Compose
• verify /api/health and roll back to the previous commit when deployment fails
• document the required GitHub Environment configuration and server prerequisites

Why

The release workflow previously stopped after publishing the GitHub Release. Production updates were manual and were not tied to the immutable release tag. This change makes the deployed revision explicit and repeatable while preserving the server's existing environment files, agent data, and Docker volumes.

Validation

• bash -n .github/scripts/deploy-release.sh
• parsed .github/workflows/release.yml with Ruby YAML
• verified the publish_release tag output and deploy_release dependency structurally
• git diff --check

Docker Compose is not installed in the local Codex environment, so the Compose config check was not run locally.

Before merge

Authorize the generated github-actions-clawith-production-2026-07-24 public key for the qinrui account on the production server. The matching private key and verified host keys are already configured in the GitHub production Environment.