KI-401 failed: the job container has no /opt/ki-staging — the staging
checkout lives on the host, not in the job container.

- deploy-staging.sh: STAGING_ROOT now defaults to the calling checkout;
  git pull is skipped in CI (STAGING_SKIP_PULL=1 or CI env) since the
  job checkout already is the deployed commit
- buildspec: deploy-staging job sets STAGING_ROOT=/opt/ki-staging (host
  path, valid via the mounted docker socket's daemon context) and
  installs sops+age in the job container

The age key and .env.staging.sops live in the host checkout; the job
reads them through STAGING_ROOT. Compose still targets the host daemon.

Co-authored-by: Syntropic Agent <syntropic-agent@kokonut.network>

KI-401: the job container cannot see /opt/ki-staging (host fs).
Run the deploy inside ki-deploy-helper (sops+age+compose image, built
on the host) with the host checkout and docker socket mounted. The
helper fast-forwards the host checkout to origin/main, then runs
deploy-staging.sh with STAGING_SKIP_PULL=1.

Also: deploy-staging.sh defaults STAGING_ROOT to its own checkout so
the script works from any location.

Co-authored-by: Syntropic Agent <syntropic-agent@kokonut.network>