infra: promote verified main to production

.github/workflows/promote-production.yml

@@ -0,0 +1,45 @@
+name: Caterium Promote Production
+
+on:
+  workflow_run:
+    workflows: ["Caterium QA"]
+    types: [completed]
+
+permissions:
+  contents: write
+
+concurrency:
+  group: caterium-production-promotion
+  cancel-in-progress: false
+
+jobs:
+  promote:
+    if: >-
+      ${{ github.event.workflow_run.conclusion == 'success' &&
+          github.event.workflow_run.event == 'push' &&
+          github.event.workflow_run.head_branch == 'main' }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout verified main
+        uses: actions/checkout@v4
+        with:
+          ref: main
+          fetch-depth: 0
+
+      - name: Verify promoted commit
+        shell: bash
+        run: |
+          set -euo pipefail
+          expected="${{ github.event.workflow_run.head_sha }}"
+          actual="$(git rev-parse HEAD)"
+          if [ "$actual" != "$expected" ]; then
+            echo "Refusing promotion: main moved after the verified QA run."
+            echo "verified=$expected current=$actual"
+            exit 1
+          fi
+
+      - name: Promote to production branch
+        shell: bash
+        run: |
+          set -euo pipefail
+          git push origin HEAD:refs/heads/production