e476e99b77
Adds a deploy job that runs after Docker images are pushed to GHCR. It checks out groombook/infra, updates all image SHA tags in the Kubernetes manifests, and commits directly to main. This ensures Flux always picks up new images after a successful build, preventing the previous issue where :latest tags caused no manifest diff and pods weren't updated. Requires INFRA_DEPLOY_TOKEN secret with push access to groombook/infra. Co-Authored-By: Paperclip <noreply@paperclip.ing>