Bind CD deploy job to production environment so AWS deploy config resolves at runtime

[Copilot]

The Deploy to Production EC2 job failed in Actions because AWS_REGION (and related deploy config) resolved empty at runtime, causing configure-aws-credentials to error before deployment began. This PR scopes the deploy job to the intended GitHub environment and clarifies config placement in deployment docs.

• Workflow: ensure environment-scoped deploy config is available

  • Updated .github/workflows/deploy.yml to run the deploy job in the production environment.
  • This allows environment-level vars/secrets to resolve for:
    • AWS_REGION
    • EC2_SECURITY_GROUP_ID

• Docs: clarify where deploy configuration must live

  • Updated deploy/README.md to explicitly state that environment-level values must be set in the production environment for this workflow.

jobs:
  deploy:
    name: Deploy to Production EC2
    runs-on: ubuntu-latest
    environment: production
    env:
      AWS_REGION: ${{ vars.AWS_REGION || secrets.AWS_REGION }}
      EC2_SECURITY_GROUP_ID: ${{ vars.EC2_SECURITY_GROUP_ID || secrets.EC2_SECURITY_GROUP_ID }}