ci: post canvas deploy reminder after every main merge

[HongmingWang-Rabbit]

Problem

5 consecutive merge cycles (PRs #21, #25, #30, #32, #34) went undeployed because the canvas container is not auto-rebuilt after CI passes and the manual rebuild step was silently forgotten each time.

Solution

Adds a canvas-deploy-reminder job to ci.yml. After every push to main where canvas-build passes, it posts a commit comment via the built-in GITHUB_TOKEN (no new secrets needed) with the exact commands to rebuild the container.

The comment looks like:

Canvas build passed ✅ — deploy required

The canvas container is not auto-deployed. Run this on the host machine to apply:

cd /g/personal_programs/molecule-monorepo
git pull origin main
docker compose build canvas && docker compose up -d canvas

Properties

• No new secrets required — uses GITHUB_TOKEN with contents: write (minimum scope for commit comments)
• Only fires on main pushes — if: github.event_name == 'push' && github.ref == 'refs/heads/main'; PR builds are unaffected
• Only fires after a clean build — needs: canvas-build means a failing build produces no comment
• Each merge gets one comment — on the merge commit SHA, not a PR comment, so it's always findable via git log
• Body written via heredoc + file — avoids shell escaping issues with embedded backticks

Test plan

• CI YAML is syntactically valid (reviewed full file)
• After this merges to main, the next canvas-touching merge should produce a commit comment on that merge SHA
• Verify the comment appears under the merge commit in GitHub's commit view

🤖 Generated with Claude Code

[HongmingWang-Rabbit]

7-gate verification passed. CI 6/6 green + 1 expected skip (the new reminder job itself, only fires on push to main). Diff is workflow-only. Security: minimal permissions (contents: write for commit comments), GITHUB_TOKEN via env, heredoc body uses quoted 'BODY' delimiter preventing expansion, no user-input interpolation into run:. Design: posts commit comment only, no auto-deploy. Merging.