feat: staging deploy workflow via deploy label

[nthh]

Summary

• Adds a CI workflow that deploys PRs to staging.remolt.dev when a maintainer adds the deploy label
• Uses the existing Cloudflare tunnel — adds/removes an ingress rule at deploy/teardown time
• Kustomize overlay in k8s/staging/ reuses base manifests with namespace + env overrides
• Race condition guard: fails if another PR already has the label
• Posts staging URL / teardown confirmation as PR comments
• Uses pull_request_target to prevent malicious PRs from exfiltrating kubeconfig

New files

• .github/workflows/staging.yml — deploy + teardown jobs triggered by label events
• k8s/staging/kustomization.yaml — overlay referencing base manifests
• k8s/staging/server-patch.yaml — env var overrides (lower limits, staging namespace/origin)
• .env.staging.example — template for staging OAuth credentials

Prerequisites (one-time manual setup)

• GitHub OAuth app for staging.remolt.dev (callback: https://staging.remolt.dev/auth/callback)
• Cloudflare DNS CNAME: staging.remolt.dev → existing tunnel UUID
• Create .env.staging from .env.staging.example, fill in OAuth creds
• Apply secret to cluster:

  source .env.staging
  kubectl create namespace remolt-staging --dry-run=client -o yaml | kubectl apply -f -
  kubectl -n remolt-staging create secret generic remolt-auth \
    --from-literal=GITHUB_CLIENT_ID=$GITHUB_CLIENT_ID \
    --from-literal=GITHUB_CLIENT_SECRET=$GITHUB_CLIENT_SECRET \
    --from-literal=COOKIE_SECRET=$COOKIE_SECRET \
    --dry-run=client -o yaml | kubectl apply -f -

No GitHub environment or extra GitHub Actions secrets needed — only the existing repo-level KUBECONFIG_BASE64.

Test plan

• Add deploy label to a PR → staging workflow runs, comment appears with URL
• Visit staging.remolt.dev → OAuth works, can create session
• Remove deploy label → teardown runs, resources cleaned up
• Two PRs with deploy label → second fails with error

🤖 Generated with Claude Code

[nthh]

Known gaps for agent web UI proxy (OpenClaw etc.)

Before testing OpenClaw end-to-end, these need to be addressed:

1. WebSocket proxy is missing. The /proxy/{session_id}/{path} route only handles HTTP methods. Agent dashboards (OpenClaw included) will almost certainly use WebSockets for real-time updates — those connections will fail silently.

2. Path rewriting. The dashboard is served at /proxy/{session_id}/ but the app expects to be at /. Asset loads (/js/app.js), API calls (/api/status), etc. will miss the proxy prefix and hit remolt's SPA fallback instead. Need either path rewriting in the proxy or a <base> tag injection.

3. Network policy verification. The current NetworkPolicy allows ingress to sandbox pods only from app: remolt-server. The proxy reaches sandbox pods via the K8s pod proxy API (not direct pod-to-pod), so this should work — but needs to be verified for non-standard ports like 18789.

4. OpenClaw specifics. We assumed npm install -g openclaw, port 18789, and specific CLI flags. These need to be validated against actual OpenClaw docs before the agent image will work.