fix(staging): robust env write + stop double-binding prod ports

Two fixes to the auto-deploy path found on the first host-mode run:
- Write deploy/.env.staging line-by-line instead of a here-string, so the step
  can't be broken by how act_runner indents/wraps the PowerShell script (the
  here-string terminator must be col 0; the runner's wrapping broke it, leaving
  POSTGRES_PASSWORD blank so postgres/api failed while frontend came up).
- Tag the staging 'ports' lists with !override so the overlay REPLACES the base
  ports instead of merging — staging no longer also binds prod's 8080/8081.
Verified locally: compose config shows only 18080/18081/15432.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docker-compose.staging.yml

@@ -21,7 +21,9 @@
 
 services:
   postgres:
-    ports:
+    # !override replaces the base port list instead of merging with it, so staging
+    # binds ONLY its shifted 18xxx/15432 ports and never squats on prod's 8080/8081.
+    ports: !override
       - "127.0.0.1:15432:5432"
 
   api:
@@ -32,13 +34,13 @@ services:
       App__DevMode: "true"
       GmailSync__MaxMessages: ${MAX_MESSAGES:-2000}
       Cors__Origins__0: ${FRONTEND_ORIGIN:-http://localhost:18081}
-    ports:
+    ports: !override
       - "127.0.0.1:18080:8080"
 
   frontend:
-    ports:
+    ports: !override
       - "18081:80"
 
   nginx:
-    ports:
+    ports: !override
       - "18000:80"