Harden EC2 deploy workflow by granting ephemeral runner SSH ingress

[Copilot]

The Deploy to Production EC2 job was failing before deployment with an SSH timeout (dial tcp ...:22: i/o timeout). This change updates CD to open EC2 SSH access only for the active GitHub Actions runner, then remove it after deployment.

• Root-cause aligned workflow change

  • Added AWS auth setup in .github/workflows/deploy.yml (aws-actions/configure-aws-credentials@v4).
  • Added pre-deploy step to detect runner public IP and authorize tcp/22 ingress for runner_ip/32 on the target security group.
  • Handles idempotency (InvalidPermission.Duplicate) to avoid failing on repeated runs.

• Post-deploy security cleanup

  • Added always() cleanup step to revoke the temporary ingress rule.
  • Handles missing-rule cleanup safely (InvalidPermission.NotFound).

• Operational robustness

  • Increased SSH action connection/command timeouts to better tolerate transient network delays during deploy.

• Deployment docs alignment

  • Updated deploy/README.md to document CI/CD SSH behavior and required repo secrets:
    • AWS_ACCESS_KEY_ID
    • AWS_SECRET_ACCESS_KEY
    • AWS_REGION
    • EC2_SECURITY_GROUP_ID

- name: Allow GitHub Actions runner SSH access
  run: |
    RUNNER_IP="$(curl -fsSL https://checkip.amazonaws.com | tr -d '\n')"
    aws ec2 authorize-security-group-ingress \
      --group-id "$EC2_SECURITY_GROUP_ID" \
      --protocol tcp --port 22 --cidr "${RUNNER_IP}/32"