[Blocker] Deploy through a staging slot with smoke test, rollback and OIDC

Tier 1 — release blocker

Problem

Production deploys are single-shot: the package goes straight to the live site with no staging slot, no smoke test, no rollback path, and authentication uses a long-lived publish-profile secret rather than federated (OIDC) credentials.

Evidence

• .github/workflows/azure-app-service.yml:98-103 — azure/webapps-deploy with publish-profile: ${{ secrets.AZURE_WEBAPP_PUBLISH_PROFILE }}

Proposed fix

1. Deploy to a staging slot.
2. Smoke test the slot (/healthz, plus one authenticated page render).
3. Swap slots on success; leave the slot in place for instant rollback.
4. Replace the publish profile with azure/login using OIDC federated credentials and delete the secret.

Acceptance criteria

• Deploys land on a slot first and swap only after the smoke test passes
• Rollback is a slot swap, not a redeploy
• No long-lived Azure credential in repository secrets

Start with .github/workflows/azure-app-service.yml:98-103 and trace the current Azure App Service deployment workflow. Check how the staging slot, /healthz smoke test, authenticated page render, slot swap, rollback path, and OIDC login fit together. Done means deployments test a slot before swapping, rollback uses a swap, and no long-lived Azure credential remains in repository secrets.