Harden CI deployment and e2e checks

[monchee]

Summary

• fail deployment loudly when either required Cloudflare credential is absent
• add one reproducible CI e2e command that builds before running the production preview tests
• update workflow actions to their current Node 24-compatible major versions
• document the new command and credential contract

Verification

• exercised all four credential combinations; only both-present succeeds
• npx tsc --noEmit
• npm run lint
• npm run test:coverage (92 files, 766 tests)
• node scripts/verify-order.mjs (116 positions, 0 mismatches)
• npm run test:e2e:ci from an absent dist directory (59 passed)
• workflow YAML parsed successfully
• git diff --check