Fix deploy CI artifact lookup for squash merges

[richardorchard]

Agent

Agent: Cursor Composer

Summary

• Deploy's resolve-ci-run assumed merge commits (second parent = PR head). The repo squash-merges to main, so single-parent commits fell back to github.sha and never matched a successful ci.yml run.
• For single-parent commits, resolve the associated PR head via the commits→pulls API, then reuse that PR's web-publish artifact as before.
• Adds pull-requests: read so the Actions token can call that endpoint.
• Clarifies the same behavior in docs/architecture/testing-policy.md.

This unblocks deploy for recent main merges (including #648) once this lands; the fixed workflow runs on the merge push itself.

Testing

• Locally verified squash commit ffa4bbb resolves to PR head ad797a94 (CI run that built web-publish)
• dotnet restore/build/test — not applicable (workflow/docs only)
• Coverage gate — not applicable (no .cs changes)

Legacy database checks

• Not required for this change

Issues

Relates to #593

Follow-up

After merge, confirm the Deploy workflow's resolve-ci-run step succeeds and post-deploy smoke goes green.

Made with Cursor