fix(ci): use dynamic proxy Dockerfile for Railway deployment

Replace railway redeploy with railway up using a dynamically generated
proxy Dockerfile. The proxy pulls the pre-built image from GHCR using
the exact SHA256 digest, avoiding Railpack source builds while ensuring
deterministic deployments.

.github/workflows/deploy.yaml

@@ -18,6 +18,8 @@ jobs:
   build-and-deploy:
     name: Build and Deploy
     runs-on: ubuntu-latest
+    outputs:
+      digest: ${{ steps.docker_build.outputs.digest }}
     steps:
       - name: Checkout
         uses: actions/checkout@v5
@@ -104,6 +106,7 @@ jobs:
             type=raw,value=latest,enable={{is_default_branch}}
 
       - name: Build and push Docker image
+        id: docker_build
         uses: docker/build-push-action@v6
         with:
           context: .
@@ -129,5 +132,8 @@ jobs:
     env:
       RAILWAY_TOKEN: ${{ secrets.RAILWAY_TOKEN }}
     steps:
+      - name: Generate proxy Dockerfile
+        run: echo "FROM ghcr.io/xevion/pac-man@${{ needs.build-and-deploy.outputs.digest }}" > Dockerfile
+
       - name: Deploy to Railway
-        run: railway redeploy --service pac-man -y
+        run: railway up --service pac-man