[EPAC-2083]: harden backend staging deploy

[riddim-developer-bot]

Why

Backend Staging Deploy is failing on main after PR #607 removed Terraform apply from the code deploy workflow. The deploy matrix now targets manifest services whose source directory or staging Lambda is not currently provisioned, and the staging account also has a deleted epac/database-url secret plus no artifact bucket variable set.

What changed

• Added source-directory and staging-Lambda existence guards before packaging or updating a service.
• Preserved the current Lambda DATABASE_URL when the staging secret is marked for deletion, instead of failing the deploy while the existing function config is still usable.
• Added the known EPAC artifact bucket as a fallback when repo variables are absent.
• Skipped route sync and smoke tests with an explicit warning when manifest HTTP services are missing staging Lambda resources, so infrastructure drift is visible without hard-failing the code deploy workflow.

Trade-offs not taken

Did not reintroduce Terraform apply into Backend Staging Deploy. PR #607 deliberately moved infrastructure provisioning out of this workflow because the staging deploy role cannot reliably initialize the Terraform backend in the current account state.

Test plan

• actionlint .github/workflows/backend-staging.yml
• git diff --check origin/main...HEAD
• python3 scripts/ci/backend_staging_smoke.py --list
• Local AWS readiness probe confirmed the missing staging Lambdas that caused the failed run are detected and would skip smoke with a warning.

Skipped: live GitHub Actions execution, because it depends on GitHub OIDC and the repository staging deploy role.

Resolves EPAC-2083

Reviewer-Boundary: review-only

Estimate was missing from the Linear issue; treated as the standard 8 complexity tier.