Fix preview deploy: use appData endpoint, not appDefinitions/update

appDefinitions/update silently ignores a top-level imageName field, so the
"deploy" step was reporting success while never actually swapping the
running image — the app stayed on CapRover's placeholder page. Deploying a
pre-built image goes through appData with a captainDefinitionContent
payload instead, same as the caprover CLI does internally.

Also required a ghcr.io registry credential in CapRover (GHCR_PULL_PAT
secret) since the preview image package is private and the node had no
credentials to pull it — confirmed via a manual deploy against pr-136 that
this now serves real routes (/events, /talk, etc.) instead of 404ing.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01W2kALmabEHRhY4yGKRKykv

Author: asyncawaitpromise

.github/workflows/preview.yml

@@ -86,11 +86,20 @@ jobs:
             -H "x-captain-auth: $ADMIN_TOKEN" \
             -d "{\"appName\": \"$APP_NAME\"}" || true
 
-          # Point app at the pre-built image and trigger deploy
           curl -sf -X POST "$CAPROVER_URL/api/v2/user/apps/appDefinitions/update" \
             -H "Content-Type: application/json" \
             -H "x-captain-auth: $ADMIN_TOKEN" \
-            -d "{\"appName\": \"$APP_NAME\", \"imageName\": \"$IMAGE\", \"instanceCount\": 1}"
+            -d "{\"appName\": \"$APP_NAME\", \"instanceCount\": 1}"
+
+          # Deploying a pre-built image is NOT done via appDefinitions/update's
+          # imageName field (that field is silently ignored) — it goes through
+          # appData with a captainDefinitionContent payload, same as the CLI.
+          CAPTAIN_DEF=$(jq -nc --arg img "$IMAGE" '{"schemaVersion":2,"imageName":$img}')
+          BODY=$(jq -nc --arg def "$CAPTAIN_DEF" '{"captainDefinitionContent":$def,"gitHash":""}')
+          curl -sf -X POST "$CAPROVER_URL/api/v2/user/apps/appData/$APP_NAME" \
+            -H "Content-Type: application/json" \
+            -H "x-captain-auth: $ADMIN_TOKEN" \
+            -d "$BODY"
 
       - name: Comment preview URL on PR
         uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7