config_generator: deep-merge sibling deploy.yml into destination file

When the consumer points base-deploy-file at a destination override
(e.g. config/deploy.staging.yml) and the shared config (deploy.yml)
defines `env: { secret: [RAILS_MASTER_KEY, ...] }` while the destination
defines `env: { clear: { RAILS_ENV: staging } }`, the previous shallow
merge replaced the entire env block with the destination's version —
dropping env.secret entirely. That left the per-PR deploy file with
no secrets list, so Kamal didn't surface RAILS_MASTER_KEY into
.kamal/apps/.../env/roles/web.env, and Rails booted with no
secret_key_base.

Deep-merge instead: hashes recurse, arrays/scalars override wins.
Matches Kamal's own merge behavior at deploy time.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: jmschneider

lib/kamal_previews/config_generator.rb

@@ -239,14 +239,27 @@ def load_base_yaml
         shared = parse_yaml(sibling)
         if shared.is_a?(Hash)
           # Destination values win where they're set; the shared file fills
-          # in everything else.
-          data = shared.merge(data) { |_key, _shared_v, dest_v| dest_v }
+          # in everything else. Deep-merge so `env: { clear: {...}, secret: [...] }`
+          # in deploy.yml and `env: { clear: { RAILS_ENV: staging } }` in the
+          # destination file combine instead of clobbering — Kamal does this
+          # at deploy time, and our generator must match.
+          data = deep_merge(shared, data)
         end
       end
 
       data
     end
 
+    def deep_merge(base, override)
+      base.merge(override) do |_key, base_v, over_v|
+        if base_v.is_a?(Hash) && over_v.is_a?(Hash)
+          deep_merge(base_v, over_v)
+        else
+          over_v
+        end
+      end
+    end
+
     def parse_yaml(path)
       raw = File.read(path)
       YAML.safe_load(raw, permitted_classes: [Date, Time], aliases: true)