ci(relay): add a forced manual relay deploy

[juliusmarminge]

Changing a relay variable in the production environment never reaches the Worker. Alchemy does not redeploy the Worker when only a Config value read in its Init changes (alchemy-run/alchemy#1831), so both a rerun and a push to main without relay code changes plan "no changes". That's why RELAY_TUNNEL_CLEANUP_MODE=dry-run is set but production still runs off. The same would happen to the incident switch back to off, and to a rotated secret such as CLERK_SECRET_KEY.

This adds a workflow_dispatch trigger to Deploy T3 Connect relay with a force input (checked by default) that runs alchemy deploy --force. The job only runs on refs/heads/main, so a manual run from another branch can't deploy that branch to production. Pushes to main behave as before.

--force makes every resource in the stack reconcile. I checked the ones that hold credentials: CloudMintKeyPair, ApnsDeliveryJobSigningSecret, the Axiom ingest tokens, and RelayPostgresRuntimeRole all keep their stored value when one already exists. A forced deploy rotates no keys, tokens or passwords.

docs/operations/release.md now says a changed variable needs a forced deploy, and uses one in the cleanup rollout, the incident switch, the rollback, and the canary.

Verification: vp run forwards --force to alchemy deploy, confirmed with a probe script. actionlint reports only the existing custom Blacksmith runner label. After merging, run the workflow from main once to apply dry-run, then check relay.managed_endpoint_reaper.mode on the next sweep span in Axiom.

🤖 Generated with Claude Code

---

Summary by CodeRabbit

• Improvements
  • Production relay deployments can now be manually run with or without a forced redeployment, and are limited to the main branch.
• Documentation
  • Updated relay release and managed tunnel cleanup guidance, including deployment, monitoring, and rollback steps.

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — The workflow adds a manual --force reconciliation path for the production relay, changing how production infrastructure and the Worker are deployed. Although the normal push path and documentation changes are low risk, the production deployment behavior warrants human review.

^{You can add or adjust custom eligibility rules. Learn more.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.5 KiB	13.5 KiB	−14 B (−0.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	7.1 KiB	7.1 KiB	−3 B (−0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.5 KiB	6.5 KiB	−11 B (−0.2%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	56.3 KiB	56.3 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	10	10	0 (0.0%)	21	✅
Claude	Total thread wire	13.5 KiB	13.5 KiB	+11 B (+0.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	7.1 KiB	7.1 KiB	+8 B (+0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.5 KiB	6.5 KiB	+3 B (+0.0%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	57.0 KiB	57.0 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	9	9	0 (0.0%)	21	✅

Baseline: 568c9bc · PR result: 2f71548 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 114.0 KiB
• Claude decoded thread snapshot: 114.7 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.