[ayushcmd]

Summary

Prepares the CloudMonitor production deployment migration from SSH (TCP port 22) to AWS Systems Manager Run Command, authenticated through GitHub Actions OIDC.

What changes

• Replaces the SSH-key/known-host based deployment workflow with OIDC + SSM Run Command.
• Adds manual operations: oidc-check, ssm-preflight, explicitly confirmed deploy, and explicitly confirmed rollback.
• Verifies the selected EC2 instance is Online as an SSM managed node before any command is sent.
• Restricts the workflow configuration to the production AWS account and a single configured EC2 instance.
• Uses a read-only SSM preflight before deployment.
• Retains Compose configuration checks, service health checks, Prometheus target checks, and a source/build rollback attempt.
• Adds docs/SSM_DEPLOYMENT_MIGRATION.md with EC2 instance-role, SSM Agent/network, GitHub OIDC trust, IAM permissions, environment variables, and rollout instructions.

Important rollout guard

This PR intentionally makes the CD workflow manual-only during the migration. It removes automatic push: main deployment until the SSM path has been configured and verified. Merging this PR will not itself deploy to EC2.

Do not re-enable automatic deployment until:

1. The existing EC2 instance has an appropriate instance profile (including AmazonSSMManagedInstanceCore).
2. SSM Agent is healthy and the instance reports Online in ap-southeast-2.
3. GitHub OIDC can assume the narrowly scoped deployment role.
4. The ssm-preflight operation succeeds.
5. A controlled production deployment and the rollback procedure have been reviewed.

Keep administrator SSH access as a break-glass path until SSM is proven.

Data safety

• The workflow checks that /home/ubuntu/cloud_monitor/.env exists and is not Git-tracked. It never prints its contents.
• It uses docker compose config, build, and up -d --remove-orphans.
• It does not run docker compose down -v, delete volumes, or recreate PostgreSQL storage.
• The scripted rollback is source/build rollback only; it does not restore database data or reverse schema migrations. Schema changes require a separate backup and compatibility plan.

Verification boundary

• Workflow YAML and embedded Bash syntax were validated locally during preparation.
• AWS account configuration, GitHub OIDC role assumption, SSM Online status, SSM command execution, production deployment, PostgreSQL persistence, and rollback have not been verified yet because AWS-side setup is pending.
• PR CI results will be reported once GitHub Actions completes.

Scope

No AWS resources are changed by this PR. No production deployment is authorized by this PR.