Remove rename-transition sub from account-baseline deploy role (#78)

Post-rename deploy verified green from seahaven-org-baseline (run
29355616637, both account jobs). The freed repo name must not stay
trusted (namespace-reuse window, security review IAC-02).

.github/workflows/cd-cdk.yaml

@@ -35,6 +35,10 @@ on:
         description: "CloudFormation stack name (for pre-flight checks)"
         type: string
         default: ""
+      stacks:
+        description: "CDK stack selector(s) to deploy (space-separated construct ids/patterns). Default deploys every stack in the app; set per job when a multi-account app splits deploys across roles."
+        type: string
+        default: "--all"
       post-deploy-script:
         description: "Optional path to a script to run after CDK deploy (e.g. web build, S3 sync)"
         type: string
@@ -121,7 +125,12 @@ jobs:
 
       - name: CDK deploy
         working-directory: ${{ inputs.cdk-dir }}
-        run: npx -y cdk deploy --all --require-approval never
+        # Env-var indirection (not inline expression interpolation) so shell
+        # metacharacters in the input are never parsed as script; unquoted
+        # $STACKS deliberately word-splits multiple selectors.
+        env:
+          STACKS: ${{ inputs.stacks }}
+        run: npx -y cdk deploy $STACKS --require-approval never
 
       - name: Post-deploy script
         if: ${{ inputs.post-deploy-script != '' }}

oidc-deploy-roles.yaml

@@ -1247,7 +1247,7 @@ Resources:
               StringEquals:
                 token.actions.githubusercontent.com:aud: sts.amazonaws.com
               StringLike:
-                token.actions.githubusercontent.com:sub: !Sub repo:${GitHubOrg}/seahaven-account-baseline:ref:refs/heads/main
+                token.actions.githubusercontent.com:sub: !Sub repo:${GitHubOrg}/seahaven-org-baseline:ref:refs/heads/main
       Policies:
         - PolicyName: cdk-deploy
           PolicyDocument: