ci(deploy): consolidate to cd.yml, align backend with Run-From-Package

- Delete .github/workflows/deploy-api.yml (duplicate of cd.yml backend job)
- Update cd.yml backend to publish with -r linux-x64 and zip on Linux,
  matching the strategy documented in DEPLOY.md Step 7.5 to avoid
  wwwroot corruption from Windows-zipped backslash paths

Author: Yuval

.github/workflows/cd.yml

@@ -40,15 +40,26 @@ jobs:
       - name: Restore
         run: dotnet restore
 
-      - name: Publish
-        run: dotnet publish -c Release -o ./publish --no-restore
+      # Publish targeting linux-x64 so the output matches the App Service
+      # runtime and does NOT include runtimes/win/* (backslash paths in those
+      # files have historically corrupted wwwroot on Linux App Service).
+      - name: Publish (linux-x64, framework-dependent)
+        run: dotnet publish -c Release -r linux-x64 --self-contained false -o ./publish-linux --no-restore
+
+      # Zip on Linux so path separators are forward slashes. Paired with
+      # WEBSITE_RUN_FROM_PACKAGE=1 on the App Service, the deploy mounts the
+      # zip read-only and avoids rsync into the locked wwwroot share.
+      - name: Package
+        run: |
+          cd publish-linux
+          zip -r ../deploy-linux.zip . -x "*.pdb"
 
       - name: Deploy to Azure App Service
         uses: azure/webapps-deploy@v3
         with:
           app-name: app-groundshare-api
           publish-profile: ${{ secrets.AZURE_WEBAPP_PUBLISH_PROFILE }}
-          package: 02-Server/publish
+          package: 02-Server/deploy-linux.zip
 
       - name: Health check
         run: |