The host-mode runner does a clean checkout without the git-ignored
deploy/.env.staging, so regenerate it from Actions secrets
(STAGING_POSTGRES_PASSWORD / STAGING_GOOGLE_CLIENT_ID / STAGING_GOOGLE_CLIENT_SECRET)
at deploy time. Drop the duplicate host build+test — 'docker compose --build'
compiles the API image in-container and CI already gates tests on the PR.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>