feat(ci): add Dev Fynd deployment workflow

[tvinagre]

Summary

• Build and promote a linux/amd64 Fynd image to Dev after tests-and-lints succeeds on main.
• Add no-input manual branch deployment with maintain/admin checks for both initial and re-run actors.
• Pin the promotion template and GitHub Script actions to reviewed commit SHAs.

Validation

• YAML/static workflow assertions and git diff --check
• Independent spec review: PASS
• Independent quality/security review: PASS

Security model

Uses the existing Tycho-parity trusted-writer model. The runtime gate requires maintain/admin for Dev promotion.