[Sprint 2] Add sandbox config template + create-sandbox script

[thatlkat]

What

Adds two files on top of the civiform-deploy fork for the CiviForm Demo Sandbox provisioner.

sandbox_civiform_config.sh.template

Template for per-sandbox civiform_config.sh files. Key sandbox-specific decisions baked in:

• Auth: FAKE_IDP (STAGING_DISABLE_DEMO_MODE_LOGINS=false) — no real OIDC/ADFS needed
• Domain: {slug}.sandbox.civiform.dev
• SSL: Wildcard cert *.sandbox.civiform.dev (pre-provisioned once, shared — ARN passed in at create time)
• Banner: SHOW_NOT_PRODUCTION_BANNER_ENABLED=true
• City branding: WHITELABEL_CIVIC_ENTITY_SHORT/LONG_NAME set per sandbox
• Notifications: All → civiform-sandbox@exygy.com (not real city addresses)

bin/create-sandbox

Script that fills in the template placeholders via sed and calls bin/setup.

bin/create-sandbox \
  --city-short="Burlington" \
  --city-full="Burlington, Vermont" \
  --slug="burlington-vt" \
  --version="v1.55.0" \
  --ssl-arn="arn:aws:acm:us-east-1:..." \
  --account-id="123456789012"

This is what EcsFargateSandboxService will call at runtime (Sprint 2). Can also be run manually for testing.

Generated configs go to configs/sandbox-{slug}.sh — gitignored.

Questions for Rocky + Sal

1. Cloudflare: Per the deploy wiki, we need dev-services@exygy.com Cloudflare access to add DNS records for *.sandbox.civiform.dev. Sal — can you get invited?
2. Wildcard cert: Should we request *.sandbox.civiform.dev as a wildcard (one cert, all sandboxes) or per-sandbox like the standard flow? Wildcard seems right for us.
3. AWS account: Using single shared account (per Chelsea). Which account ID should go in --account-id?
4. Fork: civiform-staging-deploy has forking disabled so I forked civiform-deploy instead — does this look like the right base? Rocky, LGTM on structure?

Repo

thatlkat/civiform-deploy-sandbox → transfer to civiform org once Rocky approves.