CTO review (CAR-1263 Task B). Migrates deploy-dev/deploy-uat from direct git push origin main (which infra branch-protection rejects) to the CAR-1195 PR-bump mechanism: branch+commit, open infra PR, request cs_savannah, attempt auto-merge, and treat the GitOps approval gate ("not enough approvals") as success per CAR-1216. Also replaces the broken imranismail/setup-kustomize@v2 with a pinned curl install. Job-level always()&&!cancelled() + step-level needs.build-and-push.result==success gating is correct. CI green. Approving.
CTO review (CAR-1263 Task B, main parity). Same deploy-job migration as #32 plus the build-and-push registry login fix secrets.GITEA_TOKEN->secrets.REGISTRY_TOKEN (CAR-1009 standard; uat already had it via CAR-1237). Infra PR-bump steps correctly use GITEA_TOKEN (repo scope) per CAR-1195. CI green. Approving.