fix(ci): migrate preview deploy to ECR, fix prod image mapping

[tieubao]

What's this PR does ?

Fixes the preview (develop) deploy pipeline, dead since ~July 9: gke-dev.yml still authenticated as the GCP service account k8s-671@console-labs-prod, which was deleted (every run fails at auth with invalid_grant: account not found). Mirrors the ECR/EKS migration already done for prod in gke-prod.yml.

Also fixes a latent no-op in gke-prod.yml: both kustomize overlays in consolelabs/infrastructure key their images: transform on the legacy GAR name (asia-southeast1-docker.pkg.dev/console-labs-prod/consolelabs/mochi-api, the name deployment.yaml references), but the prod workflow's kustomize edit set image used the ECR name as the OLD name, so the edit would add an entry matching nothing and the running image would never update. Never caught because prod runs died at auth first (stale 2023 AWS secrets, refreshed today).

Changes

• gke-dev.yml: GCP auth + GCR push replaced with aws-actions/configure-aws-credentials + ECR login + push to 768727713577.dkr.ecr.ap-southeast-1.amazonaws.com/mochi/api:${GITHUB_SHA}; kustomize edit keys on the legacy GAR name so the preview overlay actually rewrites.
• gke-prod.yml: kustomize edit set image old-name corrected to the legacy GAR name (one line + comment).

Verification plan

Merging this to develop triggers the new workflow on this very commit, that run IS the live test. Expected: ECR login ok, image pushed, infrastructure/mochi-api/preview/kustomization.yml gets a commit flipping newName to the ECR path with this SHA as newTag.

Not in scope

• Cleaning up the now-unused GCP_CREDENTIALS secret (leave until prod path re-verified end-to-end).
• The preview overlay's stale pre-migration newTag (232549f, July 9) self-heals on first successful run.