Get GHA pipelines established

[TTTriplicate]

This is still a draft, getting a few last things settled.

Basic idea is this:

• Set this to run on push to production branch
• set protection rules on production branch, e.g. no push to it without approval from @CodeCrow
  • Bypass rule for @CodeCrow to still be able to go if needed
• Move all secrets into the GHA settings per-environment
  • (I've added you as a contributor to this repo so you can investigate those settings)

This will hide the currently exposed secrets from anyone scraping GitHub for exactly that kind of data, as well as automatically maintaining the current Prod version of the website in sync with the current state of code.

TODO

• Needs the current exact deploy command
• Needs a way to inject the secrets for use
  • could be as simple as a heredoc dropping them into a .envrc on the runner, and putting the existing .envrc in the .gitignore
• Need to cycle the secrets so that the in-use secrets are no longer exposed.

[TTTriplicate]

If you can drop the command here, I can work out the rest