feat(deploy): add deployment script library foundation

Created library infrastructure for script extraction refactor:

Added:
- scripts/deployment/lib/ssh-helpers.sh: SSH retry and connection utilities
- scripts/deployment/lib/common.sh: Logging, validation, and helper functions

This is Phase 1 of refactoring the deploy workflow to extract large
inline scripts (health check heredoc is 24,812 chars, exceeds 21,000 limit).

Scripts will run on GitHub Actions runner and make SSH calls to remote
server as needed. This foundation provides reusable utilities for all
deployment scripts.

Next phases:
- Phase 2: Extract stack removal detection
- Phase 3: Extract health check logic
- Phase 4: Extract deployment orchestration
- Phase 5: Extract rollback logic
- Phase 6: Update workflow to use scripts

Related issue: Expression length limit exceeded on line 1214

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Author: owine

scripts/deployment/lib/common.sh

@@ -0,0 +1,86 @@
+#!/usr/bin/env bash
+# Common Utilities for Deployment Scripts
+# Provides logging, validation, and helper functions
+
+set -euo pipefail
+
+# Logging functions with colors
+log_info() {
+  echo "ℹ️  $*"
+}
+
+log_success() {
+  echo "✅ $*"
+}
+
+log_error() {
+  echo "❌ $*" >&2
+}
+
+log_warning() {
+  echo "⚠️  $*" >&2
+}
+
+# Set GitHub Actions output
+set_github_output() {
+  local key=$1
+  local value=$2
+
+  if [ -n "${GITHUB_OUTPUT:-}" ]; then
+    echo "${key}=${value}" >> "$GITHUB_OUTPUT"
+  fi
+}
+
+# Validate stack names (alphanumeric, dash, underscore only)
+validate_stack_name() {
+  local stack=$1
+
+  if [[ ! "$stack" =~ ^[a-zA-Z0-9_-]+$ ]]; then
+    log_error "Invalid stack name: $stack (must be alphanumeric with dash/underscore)"
+    return 1
+  fi
+
+  return 0
+}
+
+# Validate SHA format (40 hex characters)
+validate_sha() {
+  local sha=$1
+
+  if [[ ! "$sha" =~ ^[a-fA-F0-9]{40}$ ]]; then
+    log_error "Invalid SHA format: $sha (must be 40 hex characters)"
+    return 1
+  fi
+
+  return 0
+}
+
+# Validate 1Password reference format
+validate_op_reference() {
+  local ref=$1
+
+  if [[ ! "$ref" =~ ^op:// ]]; then
+    log_error "Invalid 1Password reference: $ref (must start with op://)"
+    return 1
+  fi
+
+  return 0
+}
+
+# Format list for output (space-separated to comma-separated)
+format_list() {
+  echo "$1" | tr ' ' ',' | sed 's/^,//;s/,/, /g'
+}
+
+# Check if variable is set and non-empty
+require_var() {
+  local var_name=$1
+  local var_value="${!var_name:-}"
+
+  if [ -z "$var_value" ]; then
+    log_error "Required variable $var_name is not set"
+    return 1
+  fi
+
+  return 0
+}

scripts/deployment/lib/ssh-helpers.sh

@@ -0,0 +1,77 @@
+#!/usr/bin/env bash
+# SSH Helper Functions for Deployment Scripts
+# Provides retry logic and SSH connection utilities
+
+set -euo pipefail
+
+# General retry function with exponential backoff
+retry() {
+  local max_attempts=$1
+  local delay=$2
+  local command="${@:3}"
+  local attempt=1
+
+  while [ $attempt -le $max_attempts ]; do
+    echo "Attempt $attempt of $max_attempts: $command"
+    if eval "$command"; then
+      echo "✅ Command succeeded on attempt $attempt"
+      return 0
+    else
+      echo "❌ Command failed on attempt $attempt"
+      if [ $attempt -lt $max_attempts ]; then
+        echo "⏳ Waiting ${delay}s before retry..."
+        sleep $delay
+        delay=$((delay * 2))  # Exponential backoff
+      fi
+      attempt=$((attempt + 1))
+    fi
+  done
+
+  echo "💥 Command failed after $max_attempts attempts"
+  return 1
+}
+
+# SSH retry function with specific error handling
+ssh_retry() {
+  local max_attempts=$1
+  local delay=$2
+  local ssh_cmd="${@:3}"
+  local attempt=1
+  local last_exit_code=1
+
+  while [ $attempt -le $max_attempts ]; do
+    echo "SSH Attempt $attempt of $max_attempts" >&2
+    if eval "$ssh_cmd"; then
+      echo "✅ SSH command succeeded on attempt $attempt" >&2
+      return 0
+    else
+      last_exit_code=$?
+      echo "❌ SSH command failed on attempt $attempt (exit code: $last_exit_code)" >&2
+
+      # Check for specific SSH errors
+      case $last_exit_code in
+        255) echo "SSH connection error - network/auth issue" >&2 ;;
+        1) echo "General SSH error" >&2 ;;
+        *) echo "Unknown error code: $last_exit_code" >&2 ;;
+      esac
+
+      if [ $attempt -lt $max_attempts ]; then
+        echo "⏳ Waiting ${delay}s before SSH retry..." >&2
+        sleep $delay
+      fi
+      attempt=$((attempt + 1))
+    fi
+  done
+
+  echo "💥 SSH command failed after $max_attempts attempts (final exit code: $last_exit_code)" >&2
+  return $last_exit_code
+}
+
+# Simple SSH execution wrapper
+ssh_exec() {
+  local ssh_user=$1
+  local ssh_host=$2
+  local command=$3
+
+  ssh -o "StrictHostKeyChecking no" "${ssh_user}@${ssh_host}" "$command"
+}