fix(deploy): fence rollback create-run on unlock success

Co-authored-by: Cursor <cursoragent@cursor.com>

.github/workflows/deploy.yml

@@ -26,6 +26,9 @@ jobs:
           dotnet-version: "8.0.x"
 
       - name: Repository quality gate
+        env:
+          BASE_REF: ${{ github.event.pull_request.base.sha || 'origin/dev' }}
+          HEAD_REF: ${{ github.event.pull_request.head.sha || github.sha }}
         run: bash scripts/governance-check.sh
 
       - name: Build Elastic Beanstalk source bundle
@@ -414,6 +417,7 @@ jobs:
         id: rollback-prepare
 
       - name: Discard blocking VCS run before GitHub rollback
+        id: rollback-discard-vcs
         if: failure() && steps.rollback-prepare.outputs.rollback_label != ''
         run: |
           set -euo pipefail
@@ -502,7 +506,7 @@ jobs:
 
       - name: Create Terraform rollback run
         id: rollback-run
-        if: failure() && steps.rollback-prepare.outputs.rollback_label != ''
+        if: failure() && steps.rollback-prepare.outputs.rollback_label != '' && steps.rollback-discard-vcs.outcome == 'success'
         uses: hashicorp/tfc-workflows-github/actions/create-run@8e08d1ba957673f5fbf971a22b3219639dc45661 # v1.3.2
         env:
           TF_VAR_release_version_label: '"${{ steps.rollback-prepare.outputs.rollback_label }}"'