Harden CD deploy job by adding ephemeral runner-scoped SSH ingress

[Copilot]

The Deploy to Production EC2 job was failing before deployment logic executed because the GitHub-hosted runner could not establish SSH to EC2 (port 22 timeout). This change updates the CD workflow to grant runner-scoped SSH access just-in-time and always clean it up after deployment.

• Root-cause alignment: runner could not reach EC2 over SSH

  • Capture runner public IP at runtime (/32) and use it as the only temporary ingress source.
  • Keep deployment behavior unchanged once SSH connectivity is available.

• Workflow hardening in .github/workflows/deploy.yml

  • Add pre-deploy ingress authorization step:
    • aws ec2 authorize-security-group-ingress --port 22 --cidr "$RUNNER_IP"
  • Add post-deploy cleanup step with if: always():
    • aws ec2 revoke-security-group-ingress --port 22 --cidr "$RUNNER_IP"
  • Handle idempotent edge cases (InvalidPermission.Duplicate / InvalidPermission.NotFound) without masking real failures.

• Operational documentation update

  • Update deploy/README.md to document that CD opens SSH only for the active runner IP and revokes it afterward.

- name: Get GitHub Runner Public IP
  run: echo "RUNNER_IP=$(curl -s https://checkip.amazonaws.com)/32" >> "$GITHUB_ENV"

- name: Authorize temporary SSH access for GitHub Runner
  run: aws ec2 authorize-security-group-ingress --group-id "$EC2_SECURITY_GROUP_ID" --protocol tcp --port 22 --cidr "$RUNNER_IP"

# ... existing SSH deploy step ...

- name: Revoke temporary SSH access for GitHub Runner
  if: always()
  run: aws ec2 revoke-security-group-ingress --group-id "$EC2_SECURITY_GROUP_ID" --protocol tcp --port 22 --cidr "$RUNNER_IP"