Deploy updated metadata after successful sync

[rossgalloway]

Summary

Sync commits use GITHUB_TOKEN, so their pushes do not trigger the deployment workflow added in #164. Explicitly request a deployment after a successful metadata push on the default branch, keeping the production site’s commit-pinned metadata current.

How to review

Review the final step in .github/workflows/sync.yml: it dispatches only when metadata changed and the sync ran on the default branch. .github/workflows/vercel-deploy.yml adds the matching manual trigger.

Draft — do not merge yet: The pinned yearn/yearn-gha workflow rejects workflow_dispatch for production. A companion change must allow that event only on the default branch, and this PR must then pin the approved shared-workflow commit. Verify/update the CMS Doppler OIDC policy as well: the shared-workflow documentation specifies an event_name: push restriction and a pinned job_workflow_ref.

Test plan

• Parse both modified workflow YAML files and run git diff --check.
• Inspect the pinned shared workflow and identify its dispatch restriction before attempting a deployment.
• Validate the complete workflow after the shared-workflow and OIDC prerequisites are resolved.
• After merge, verify a changed sync starts a deployment containing its metadata commit; an unchanged sync should not start a deployment.

Risk / impact

Adds actions: write to the sync job so it can explicitly dispatch the deployment workflow. Dispatch happens after the push succeeds and only on the default branch. No secrets or metadata formats change. A dispatch request confirms acceptance, not deployment completion. Reverting this change restores the previous sync-only behavior.

[github-actions]

Deploy preview for cms ready!

Project:	cms
Status:	✅  Deploy successful!
Preview URL:	https://cms-6byw6z55y-yearn.vercel.app
Latest Commit:	938765f

Deployed with vercel-action

[rossgalloway]

/review