ci: deploy staging services to ECS

[suguanYang]

Summary

• add an explicit staging ECS deployment path for the shared knowhere-fargate cluster
• run staging Alembic migrations against the direct Neon migration URL before ECS deployment
• resolve immutable ECR digests, render/register task definitions, and update existing API/worker services
• keep EKS available only through an explicit staging rollback dispatch and preserve production release behavior

Required operator prerequisites

The workflow intentionally does not create AWS resources. Before merging and running the staging path, create and verify the approved runtime Secrets Manager JSON secret, CloudWatch log groups, networked ECS services, and API load-balancer target. Configure AWS_ECS_STAGING_SECRETS_ARN and STAGING_MIGRATION_DATABASE_URL as GitHub Actions secrets.

Verification

• YAML parsing passed
• embedded workflow shell syntax passed
• python3 -m pytest -q deploy/ecs/test_render_task_definitions.py passed (4 tests)
• git diff --check passed

No staging deployment was triggered by this PR.