Add TEST environment and complete the promotion chain

[arielr-lt]

Summary

Brings the pipeline to the full DEV → TEST → SANDBOX → PRODUCTION model from the xTRA Design Document. Each tier is isolated; TEST is now the build target, and SANDBOX and PROD receive promoted images via crane copy.

Infrastructure

• infra/terraform/envs/test/ (new): VPC 10.42.0.0/16, EKS ctdl-xtra-test, RDS db.t4g.small Single-AZ, EFS, 1× t3.medium system + 1× t3.medium app, ECR repos ctdl-xtra-test/{api,worker,base}
• infra/terraform/envs/sandbox/: drops the base ECR (builds happen in test now). 2 resources destroyed (repo + lifecycle policy). No impact on running sandbox pods — the images they're running embed the base layers.
• github-ci-oidc/: adds TestReadWrite policy for ctdl-xtra-test/*, tightens SandboxPromote (formerly SandboxReadWrite) since sandbox is promote-only now, adds the ctdl-xtra-test cluster to eks:DescribeCluster

Manifests

• k8s-manifests/test/: clone of sandbox set, host xtra-test.credentialengineregistry.org, IRSA + secret keys retargeted

CI/CD

• release.yml — pushes to ctdl-xtra-test/{api,worker} (was sandbox)
• deploy-test.yml (new) — triggered by workflow_run on Release success; auto-deploys the just-built image to ctdl-xtra-test. This is the "automatic when possible" deployment the design doc specifies for TEST.
• promote-sandbox.yml — now crane copys test → sandbox before deploying
• promote-production.yml — unchanged (still crane-copies sandbox → prod)
• build-base.yml — pushes to ctdl-xtra-test/base
• Dockerfile + worker.Dockerfile — FROM ctdl-xtra-test/base:latest

Docs

INFRASTRUCTURE-SUMMARY.md and CI-CD.md updated for the 3-env model.

Apply plan (post-merge)

1. terraform apply github-ci-oidc/ (0 add + 2 changed)
2. terraform apply envs/test/ (79 adds, ~15 min)
3. terraform apply envs/sandbox/ (0 add + 2 destroy: drops the unused base repo)
4. Trigger Build Base Image to populate ctdl-xtra-test/base:latest
5. Run k8s-manifests/test/addons/install-foundation.sh
6. Trigger Release → pushes images to test ECR → Deploy to TEST auto-fires → app reachable at xtra-test.credentialengineregistry.org
7. Add Route53 CNAME xtra-test.* → new ALB
8. Smoke test

Production untouched. Sandbox keeps running its current images (the next promote-sandbox will pull from test).

Test plan

• terraform fmt && terraform validate clean for all three stacks
• terraform plan clean: test 79 add, sandbox 2 destroy, oidc 2 change
• After apply: end-to-end deploy via workflows succeeds
• App reachable at https://xtra-test.credentialengineregistry.org
• Promote test → sandbox works
• Promote sandbox → prod still works (no source URI changed for that step)