fix: staging deploy pulls GHCR edge image instead of rebuilding

On master pushes, the deploy job now attempts to pull the pre-built
ghcr.io/kpa-clawbot/corescope:edge image (published by the publish
workflow) and tags it as corescope-go:latest for docker-compose.

Falls back to the locally built image from the build job if the GHCR
pull fails (e.g. publish workflow not yet merged, or network issues).

PR builds are unaffected — the build job still runs for all pushes.

.github/workflows/deploy.yml

@@ -276,6 +276,18 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v5
 
+      - name: Pull GHCR edge image (or fall back to local build)
+        run: |
+          GHCR_IMAGE="ghcr.io/kpa-clawbot/corescope:edge"
+          echo "Attempting to pull $GHCR_IMAGE ..."
+          if docker pull "$GHCR_IMAGE" 2>/dev/null; then
+            # Tag as the local image name that docker-compose.staging.yml expects
+            docker tag "$GHCR_IMAGE" corescope-go:latest
+            echo "✅ Using pre-built GHCR edge image"
+          else
+            echo "⚠️ GHCR pull failed — using locally built image from build job"
+          fi
+
       - name: Deploy staging
         run: |
           # Stop old container and release memory