Fargate task runs ARM64 but GHA runner is x86_64 — without QEMU the Docker image gets built for the wrong architecture, causing exec format error at container startup.
* Add GitHub Actions deploy workflow (OIDC) * Add permissions block for OIDC token exchange * Add concurrency control to prevent parallel deploys