ci: add deployment secret contract validation

.github/workflows/secret-contract.yml

@@ -0,0 +1,45 @@
+name: Deployment Secret Contract
+
+on:
+  workflow_dispatch:
+  push:
+    branches: [staging, main]
+    paths:
+      - '.github/workflows/secret-contract.yml'
+      - 'docs/BRANCHING_AND_SECRETS.md'
+
+permissions:
+  contents: read
+
+jobs:
+  validate-contract:
+    runs-on: ubuntu-latest
+    environment: ${{ github.ref_name == 'main' && 'production' || 'staging' }}
+    env:
+      SUPABASE_PROJECT_REF: ${{ secrets.SUPABASE_PROJECT_REF }}
+      SUPABASE_URL: ${{ secrets.SUPABASE_URL }}
+      SUPABASE_SECRET_KEY: ${{ secrets.SUPABASE_SECRET_KEY }}
+      TELEGRAM_API_ID: ${{ secrets.TELEGRAM_API_ID }}
+      TELEGRAM_API_HASH: ${{ secrets.TELEGRAM_API_HASH }}
+    steps:
+      - name: Validate required deployment secrets exist
+        shell: bash
+        run: |
+          set -euo pipefail
+          missing=0
+          for name in SUPABASE_PROJECT_REF SUPABASE_URL SUPABASE_SECRET_KEY TELEGRAM_API_ID TELEGRAM_API_HASH; do
+            if [ -z "${!name:-}" ]; then
+              echo "Missing required secret: $name"
+              missing=1
+            fi
+          done
+          exit "$missing"
+      - name: Confirm safe defaults
+        env:
+          EXTERNAL_SEND_ENABLED: ${{ vars.EXTERNAL_SEND_ENABLED }}
+        shell: bash
+        run: |
+          if [ "${EXTERNAL_SEND_ENABLED:-false}" != "false" ]; then
+            echo 'External Telegram sending must remain disabled until approval controls are validated.'
+            exit 1
+          fi