Deploy infrastructure changes automatically from main

[ali509]

Summary

• add a protected infrastructure deployment workflow triggered after deployable templates merge to main
• detect changed templates and update only the corresponding existing dev stacks
• add a dedicated infrastructure GitHub OIDC role
• add a separate CloudFormation execution role
• preserve application and infrastructure deployment-role separation
• retain manual dispatch for targeted or ordered stack updates
• document automatic deployment behavior and intentional exclusions

Safety

• PRs remain validation-only
• missing stacks are not created automatically
• deployments are serialized
• github-oidc.yaml and root.yaml remain manual
• existing stack parameters are preserved

Validation

• cfn-lint passed for all deployable templates and github-oidc.yaml
• cfn-guard passed
• workflow and CloudFormation YAML parsed successfully
• non-executed change set contains only two IAM role additions and no replacements