Demos: keyless OIDC CI/CD for on-platform example apps

[MajorTal]

What

Adds demos/ — example run402 apps that auto-deploy to their own run402 projects on push to main, via keyless GitHub OIDC: each push exchanges the GitHub Actions OIDC token for a short-lived, deploy-scoped run402 CI session (run402's own CI-binding / OIDC-federation feature), then deploys through /content/v1 + /apply/v1. No run402 credential is stored in CI.

This is also peak dogfood — the run402 demos deploy to run402 using exactly the keyless flow we tell customers to use.

Layout

demos/
  _deploy/            # shared toolkit (registry, change-detection, the
                      # /content+/apply engine, the dispatcher, OIDC exchange,
                      # a registry gate) — no demo of its own
  <name>/
    app.json          # checked-in, NON-SECRET deploy target (project_id, binding_id, …)
    public/           # static site (the generic deploy ships this)
    deploy.ts         # OPTIONAL — only demos with functions/DB need a custom spec

.github/workflows/deploy-demos.yml is the change-detected matrix workflow (environment: demos scopes the OIDC subject the run402 bindings pin). A change under demos/<name>/** deploys that demo; a change under demos/_deploy/** redeploys all. Only provisioned demos (a real project_id in app.json) are ever in the matrix — so this is a safe no-op for the source-only demos until they're onboarded.

Status

Demo	URL	Status
test-video	https://test-vid.run402.com	✅ provisioned + live (static)
passkeys	https://passkeys.run402.com	✅ provisioned + live (static)
cosmicforge / evilme / social-todo	—	source-only — need onboarding (functions / DB / secrets)
mpp-test	—	local dual-rail payment server, not deployable

The two provisioned demos reuse system projects (non-billable/transferable/freezeable, deploy-tier-exempt) with CI bindings scoped to repo:kychee-com/run402:environment:demos.

Safety

• demos/_deploy/check-registry.mjs fails the build if any app.json carries a secret-bearing key. Verified no secret values are committed (the app.json binding_id is a revocable handle; the anon token is public by design).
• Merging this activates the demos' CI; the workflow no-ops for everything except the two provisioned demos.

🤖 Generated with Claude Code