Deployment: Fix $HOME issue #298

Describe the bug
The production release workflow (.github/workflows/create-release.yml) fails during the deploy step, so new releases never reach production. The v0.6.0 release failed this way, and production is still running v0.5.0.

The "Wait for SSM command to finish" step ends with:

Deployment ended with status: Failed
{
    "Status": "Failed",
    "Stdout": "",
    "Stderr": "fatal: $HOME not set\nfailed to run commands: exit status 128"
}

Root cause

• The deploy runs on EC2 through SSM AWS-RunShellScript, which executes as root without $HOME set.
• The first remote command is git config --global --add safe.directory .... --global needs $HOME, so git exits with code 128 before anything is deployed.
• chore(deployment): Improve build process #292 ("Improve build process") rewrote the remote command and dropped the user setup that production had before, and that deploy-staging.yml still has:
  • export HOME=/home/$ROOT_USER: fixes the error above.
  • NVM setup (NVM_DIR + nvm.sh): without it, root can't find the right node/npm, so npm ci and npm run build would fail next.
  • sudo -iu $ROOT_USER pm2 restart: the app runs under that user's pm2, so a root pm2 restart would not find it.

Impact

• Every production release fails until this is fixed. v0.6.0 (video column support, feat(assessment): Add video column support #297) is not live.
• The command fails on its first line, so nothing on the server changed. Production is still on v0.5.0 (41a4c07).

To Reproduce

1. Push a release tag (e.g. v0.6.0).
2. The "Deploy Kaapi to EC2 Production" workflow runs. verify-ci passes, then deploy fails at "Wait for SSM command to finish" with fatal: $HOME not set.

Expected behavior
The release tag deploys to production: checkout, npm ci, build, and pm2 restart all succeed.

Fix
Restore ROOT_USER (from the existing USER secret in the AWS_ENV environment), export HOME, the NVM setup and sudo -iu $ROOT_USER pm2 restart in create-release.yml, matching deploy-staging.yml. Re-running the failed v0.6.0 workflow won't help, because a tag runs the workflow file from its own commit. A new release (v0.6.1) is needed after the fix is merged.