Add GitHub Actions deploy workflow to 4 agent templates

[dhruv0811]

Summary

• Adds .github/workflows/deploy.yml in agent-langgraph, agent-langgraph-advanced, agent-openai-agents-sdk, and agent-openai-advanced. Authenticates via GitHub OIDC workload identity federation, validates the bundle, deploys, and runs bundle run <app-key> so the app actually restarts with the new code.
• Lists the workflow under Key Files in each template's AGENTS.md.
• The two advanced templates carry an inline comment about the one-time autoscaling Lakebase postgres wiring that must happen before CI takes over (per .claude/skills/deploy/SKILL.md).

Why

End users of these templates have no paved path for deploying from CI today. The generic dev-tools/ci-cd/github.md docs do not cover Apps (they miss the mandatory bundle run step), and nothing in this repo ships a starter workflow. This adds the shortest viable shipping path: a working, commented workflow file plus a pointer from AGENTS.md.

Accompanying internal docs (canonical Apps CI/CD page + agent-specific page + Productionize overview) will land in a follow-up universe PR once the in-flight AI Gateway (#1831872) and load-testing (#1816018) docs merge, so all three production-concern pages can nest under a new Productionize your agent parent.

Design notes

• Trigger is workflow_dispatch only, with push: branches: [main] commented out. Safer default — users opt-in once they have secrets configured.
• Auth is OIDC federation (DATABRICKS_AUTH_TYPE: github-oidc, DATABRICKS_HOST, DATABRICKS_CLIENT_ID) — no long-lived secrets. The workflow's header comment links to dev-tools/auth/provider-github for the one-time federation policy setup.
• Deploys to the prod target with explicit --target prod. Users must configure targets.prod.workspace.host or workspace.root_path in databricks.yml before the workflow will succeed; this is noted in the workflow's header comment.
• bundle run is a separate step, not chained. Makes it easy to see whether deploy or run failed.
• Scope: only the 4 templates requested. agent-non-conversational, agent-migration-from-model-serving, agent-openai-agents-sdk-multiagent, and agent-langchain-ts are deliberately skipped.
• Not synced via .scripts/sync-* — the workflow file is not a shared source. If it starts to drift across templates, we can promote it to a sync source later.

Test plan

• Verify each deploy.yml is at <template>/.github/workflows/deploy.yml (nested, not at the monorepo root — GH Actions only scans the repo-root .github/workflows/, so these files don't run in this repo; they run only once a user makes a template their repo root).
• Manually dry-run: clone agent-langgraph as a new repo, set up an SP + federation policy + GH environment, trigger the workflow, confirm it deploys and the app restarts.
• Manually dry-run for agent-langgraph-advanced: confirm that the one-time Lakebase postgres wiring is done before the workflow is triggered, then verify workflow succeeds.
• Confirm AGENTS.md rendering: workflow row in Key Files table.