ci(sandbox): auto-bump studio-sandbox image in deco-apps-cd (stg)

[viktormarinho]

What is this contribution about?

The studio-sandbox image builds automatically on merge (release-studio-sandbox.yaml), but — unlike the mesh image — nothing bumps its tag in decocms/deco-apps-cd, so the deployed tag drifts (currently pinned 1.2.3 while the repo is at 1.3.2) and sandbox changes never roll out until someone edits the CD repo by hand. This adds the missing GitOps step, mirroring release-mesh: when a new image is pushed, fire a generic image-bump repository_dispatch to deco-apps-cd (handled by its existing bump-image.yml, which self-commits the tag — no CD-repo change needed). Only studio-sandbox-stg is bumped (it auto-syncs → rolls + tests automatically); studio-sandbox-prod stays a deliberate manual promotion because it's auto-sync by default, so auto-bumping it would roll prod on every release.

How to Test

1. Merge → on the next packages/sandbox/** change with a version bump, release-studio-sandbox builds the image, then the bump-deco-apps-cd job dispatches image-bump to deco-apps-cd.
2. deco-apps-cd's bump-image.yml commits the new tag into apps/studio-sandbox-stg/values.yaml; ArgoCD (stg auto-sync) rolls it.
3. No new image (version unchanged) → the bump job is skipped (pushed == 'true' gate).

Migration Notes

Needs the existing DEPLOY_REPO_TOKEN secret (already used by release-mesh); absent → the job no-ops. To later auto-bump prod too, add apps/studio-sandbox-prod/values.yaml to files after setting syncPolicy.automated: null on studio-sandbox-prod in deco-apps-cd (mirroring deco-studio).

Review Checklist

• PR title is clear and descriptive
• Changes are tested and working
• No breaking changes

---

Summary by cubic

Automatically bumps the studio-sandbox image tag in decocms/deco-apps-cd for staging when a new image is built, keeping stg deploys in sync without manual edits. Mirrors the mesh flow; production stays a manual promotion.

• New Features

  • Adds a bump-deco-apps-cd job to release-studio-sandbox.yaml that dispatches image-bump to decocms/deco-apps-cd via peter-evans/repository-dispatch@v3.
  • Updates only apps/studio-sandbox-stg/values.yaml; prod is not auto-bumped.
  • Runs only when a new image is pushed; safely no-ops if DEPLOY_REPO_TOKEN is missing.

• Migration

  • Requires DEPLOY_REPO_TOKEN. To later include prod, disable its auto-sync and add apps/studio-sandbox-prod/values.yaml to the dispatch payload.

^{Written for commit 34ef676. Summary will update on new commits.}