Add a start flag, and let --check survive a first deploy

-e start=false (mode sync in CI) lands the payload and starts nothing, for
migrations. A check run on a never-deployed stack now skips Compose with a note
instead of failing on the missing directory.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.github/workflows/deploy.yml

@@ -30,12 +30,15 @@ on:
           - webapp
           - webapp-staging
       mode:
-        description: check reports what would change; deploy does it
+        description: >-
+          check reports what would change; sync copies the files but starts
+          nothing; deploy does both
         required: true
         default: check
         type: choice
         options:
           - check
+          - sync
           - deploy
       pull:
         description: >-
@@ -96,7 +99,7 @@ jobs:
             ''|*[!a-z0-9_-]*) echo "refusing STACK='$STACK'"; exit 1 ;;
           esac
           case "$MODE" in
-            check|deploy) ;;
+            check|sync|deploy) ;;
             *) echo "refusing MODE='$MODE'"; exit 1 ;;
           esac
           # An unchecked value can smuggle extra `-e` overrides onto the command
@@ -145,6 +148,10 @@ jobs:
           # with no error message and a green-looking cancel.
           if [ "$MODE" = "check" ]; then
             set -- --check --diff
+          elif [ "$MODE" = "sync" ]; then
+            # A real run that stops before Compose: the payload lands, the
+            # directories and networks are created, no container is touched.
+            set -- -e start=false
           else
             set --
           fi