Promote stage → main (prod deploy)

.env.example

@@ -62,6 +62,12 @@ INNGEST_DEV=1
 # NEXT_PUBLIC_SENTRY_ENVIRONMENT=development   # deploy sets staging | production
 # NEXT_PUBLIC_SENTRY_RELEASE=                  # deploy sets the git SHA
 #
+
+# ── Advanced filters UI (docs/ADVANCED-FILTERS-BRIEF.md Phase 3) ───────────────
+# Kill switch between the new field->operator->value bar and the legacy
+# dropdown toolbar on the leads table. Off (unset) everywhere until sign-off.
+# NEXT_PUBLIC_ADVANCED_FILTERS=1
+#
 # Source-map upload only (CI). SENTRY_AUTH_TOKEN is a real credential and rides a
 # BuildKit secret mount in the Dockerfile, never a build arg. Without it the build
 # still succeeds — it just skips source maps, so prod traces would be minified.

.github/workflows/deploy-staging.yml

@@ -61,6 +61,7 @@ jobs:
             NEXT_PUBLIC_SENTRY_RELEASE=${{ github.sha }}
             SENTRY_ORG=${{ secrets.SENTRY_ORG }}
             SENTRY_PROJECT=${{ secrets.SENTRY_PROJECT }}
+            NEXT_PUBLIC_ADVANCED_FILTERS=1
           # Real credential — mounted as a BuildKit secret so it never lands in
           # the image layer metadata that gets pushed to GHCR.
           secrets: |

Dockerfile

@@ -21,6 +21,10 @@ ARG NEXT_PUBLIC_SENTRY_ENVIRONMENT
 ARG NEXT_PUBLIC_SENTRY_RELEASE
 ARG SENTRY_ORG
 ARG SENTRY_PROJECT
+# Advanced filters kill switch (docs/ADVANCED-FILTERS-BRIEF.md Phase 3.5). Same
+# inlined-at-build-time rule as the rest of this block — undefined here means
+# the deployed bundle renders the legacy toolbar regardless of runtime env.
+ARG NEXT_PUBLIC_ADVANCED_FILTERS
 
 ENV NEXT_PUBLIC_SUPABASE_URL=$NEXT_PUBLIC_SUPABASE_URL
 ENV NEXT_PUBLIC_SUPABASE_ANON_KEY=$NEXT_PUBLIC_SUPABASE_ANON_KEY
@@ -30,6 +34,7 @@ ENV NEXT_PUBLIC_SENTRY_ENVIRONMENT=$NEXT_PUBLIC_SENTRY_ENVIRONMENT
 ENV NEXT_PUBLIC_SENTRY_RELEASE=$NEXT_PUBLIC_SENTRY_RELEASE
 ENV SENTRY_ORG=$SENTRY_ORG
 ENV SENTRY_PROJECT=$SENTRY_PROJECT
+ENV NEXT_PUBLIC_ADVANCED_FILTERS=$NEXT_PUBLIC_ADVANCED_FILTERS
 ENV NODE_OPTIONS="--max-old-space-size=6144"
 
 # SENTRY_AUTH_TOKEN is a real credential, so it rides a BuildKit secret mount