* Add GitHub Actions deploy workflow (OIDC) * Add permissions block for OIDC token exchange * Add concurrency control to prevent parallel deploys