fix(ci): forward NEXT_PUBLIC_GTM_ID to client docker build (AM-640)

[mitoperni]

Summary

Final missing wire for AM-640 (GA install via GTM). The previous PRs added the env var to:

• env validation (#344 — client/src/env.mjs)
• Terraform schema (#344 — infrastructure/)
• Docker compose + Dockerfile (#348 — docker-compose.yml, client/Dockerfile)

But the GitHub Actions workflow (cicd.yml) explicitly enumerates each build-args line, so a new var stays invisible to the build until added here. Without this line, NEXT_PUBLIC_GTM_ID bakes in as empty string and <GoogleTagManager> never renders — which is what we observe on dev.amazoniaforever360.org right now.

GTM ID is a public identifier (visible in browser network requests), so this uses vars. not secrets. — matches NEXT_PUBLIC_URL, NEXT_PUBLIC_API_URL, NEXT_PUBLIC_WEBSHOT_URL.

Test plan

• Confirm TF_CLIENT_NEXT_PUBLIC_GTM_ID is set as a variable (not secret) in the GitHub Environments for development, staging, production.
• Merge → wait for dev deploy.
• On https://dev.amazoniaforever360.org/es: accept cookies → DevTools → window.dataLayer populated, GET gtm.js?id=GTM-M4DCMK4 fires.
• View source on a page → googletagmanager.com appears in the bundle.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
amazonia-360	Ignored		May 21, 2026 10:08am

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud