Fix CD deploy workflow failure when AWS region/security-group are configured as repository variables

[Copilot]

The Deploy to Production EC2 job was failing before deployment because configure-aws-credentials received an empty aws-region. The workflow expected region/SG values only from secrets, while runtime configuration was provided differently.

• Workflow config hardening

  • Updated deploy job env resolution to support repository variables with secret fallback:
    • AWS_REGION: ${{ vars.AWS_REGION || secrets.AWS_REGION }}
    • EC2_SECURITY_GROUP_ID: ${{ vars.EC2_SECURITY_GROUP_ID || secrets.EC2_SECURITY_GROUP_ID }}
  • Keeps backward compatibility for repos still using secrets.

• Deployment docs alignment

  • Clarified required credential secrets vs non-sensitive deploy config values that can be set as variables (or secrets).

env:
  AWS_REGION: ${{ vars.AWS_REGION || secrets.AWS_REGION }}
  EC2_SECURITY_GROUP_ID: ${{ vars.EC2_SECURITY_GROUP_ID || secrets.EC2_SECURITY_GROUP_ID }}