Deploy from CI with Infisical and ship Payload changes as migrations

CI reads Infisical staging as the read-only convexmonorepo-ci machine identity, deploys the Convex functions, builds and pushes the image, and asks the VPS to redeploy. Payload schema changes now ship as migrations that production runs on startup; the baseline matches the production schema and is recorded as applied there. The local stack moves to its own ports and syncs the Convex runtime env, and the scripts pick up Infisical account switching, dev-kill and a cache-safe CI install.

scripts/ci-install

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+# Install on a runner, and survive a half-written cache entry.
+#
+# Runners have failed twice with "Fail extracting tarball" on a different
+# package each time, on different machines, and passed on a re-run. The cache
+# is shared between jobs on a host, so a job that dies mid-write leaves an
+# entry the next job cannot read. Clearing it and installing again costs a
+# couple of minutes; a human re-running the job costs however long it takes
+# someone to notice.
+set -euo pipefail
+if bun install --frozen-lockfile; then exit 0; fi
+echo "Install failed. Clearing the bun cache and trying once more." >&2
+rm -rf "${BUN_INSTALL_CACHE_DIR:-$HOME/.bun/install/cache}"
+bun install --frozen-lockfile