ci: run d1 migrations during cloudflare deploy

Author: kilingzhang

.github/workflows/deploy-cloudflare.yml

@@ -128,9 +128,7 @@ jobs:
         run: pnpm install --frozen-lockfile
 
       - name: Deploy relay
-        run: |
-          make relay-deploy-dry-run
-          pnpm --dir relay exec wrangler deploy --domain "$RELAY_DOMAIN"
+        run: make relay-deploy
 
   deploy-workbench:
     name: Deploy Workbench Pages

README.md

@@ -162,10 +162,9 @@ CLOUDFLARE_API_TOKEN
 CLOUDFLARE_ACCOUNT_ID
 ```
 
-The Cloudflare token must be able to deploy Workers and Cloudflare Pages. D1
-migrations still run through `make relay-deploy`; enable D1 write on the deploy
-token before switching the GitHub Actions relay step to that target. The
-workflow uses these defaults:
+The Cloudflare token must be able to deploy Workers and Cloudflare Pages, and
+it must include D1 write access because the relay deployment applies remote D1
+migrations before publishing the Worker. The workflow uses these defaults:
 
 ```text
 ACP_RUNTIME_REPO_URL=https://github.com/saaskit-dev/acp-runtime.git