[codex] Add AWS t9 staging hub environment

[winrey]

Summary

• Add first-class AWS t9 staging Terraform stack for ahand-hub-staging on openclaw-hive-dev.
• Wire staging branch into the global hub deploy workflow and deploy/hub/deploy.sh.
• Add a lightweight staging config guard plus runbook/spec/plan docs.

Live AWS validation

• terraform -chdir=infra/envs/staging plan returned No changes, confirming the remote staging stack already matches this configuration.
• /ahand-hub/staging/SENTRY_DSN was set from the existing global hub DSN so Sentry SDK capture is enabled with SENTRY_ENVIRONMENT=staging.
• ECR ahand-hub:staging was retagged to the main merge image 8b811736b39e6592084db96de92545ce2f54c5e6 and deploy/hub/deploy.sh staging completed with ECS stable.
• https://ahand-hub.staging.team9.ai/api/health returned { "ok": true }.

Test Plan

• bash scripts/verify-aws-staging-config.sh
• ruby -e 'require "yaml"; YAML.load_file(".github/workflows/deploy-hub.yml"); puts "yaml ok"'
• bash -n deploy/hub/deploy.sh
• terraform fmt -check infra/modules/ahand-hub infra/envs/dev infra/envs/staging
• terraform -chdir=infra/envs/staging init -backend=false
• terraform -chdir=infra/envs/staging validate
• terraform -chdir=infra/envs/staging init
• terraform -chdir=infra/envs/staging plan -out=/tmp/ahand-t9-staging.tfplan