Deploy job: automated API update script fails with 403 permission error

[anth-volk]

Problem

The Deploy job in the push workflow (.github/workflows/push.yaml) silently fails when trying to bump policyengine-us in the downstream API repos. The update_api.py script cannot push branches or create PRs in policyengine-api or policyengine-household-api.

Error output:

remote: Permission to policyengine/policyengine-api.git denied to policyengine[bot].
fatal: unable to access 'https://github.com/policyengine/policyengine-api/': The requested URL returned error: 403
pull request create failed: GraphQL: Resource not accessible by integration (createPullRequest)

Same errors repeat for policyengine-household-api.

Root Cause

The push-based approach (upstream clones downstream repos and pushes) is fundamentally fragile:

1. GitHub App token scoping issues (token only valid for current repo)
2. Git credential helper conflicts on GH Actions runners causing clones to hang
3. No error handling (os.system() calls)
4. 5-minute time.sleep() waiting for PyPI propagation

Solution

Replace with a pull-based cron model where each downstream repo polls PyPI for new versions:

• policyengine-api: New cron workflow polling every 30 min (PR: Add cron-based country package update workflow policyengine-api#3330)
• policyengine-household-api: Already has a working weekly cron workflow; old unused bump script removed (PR: Delete unused gcp/bump_country_package.py policyengine-household-api#1450)
• policyengine-us: Remove the broken Deploy job and update_api.py entirely