Add deploy failure evidence artifacts

[davejohnson]

What changed

• Add a post-failure evidence job to every generated CI deploy workflow.
• Read only the completed failed deploy job log with read-only Actions permission.
• Keep the final 400 lines, redact credential-shaped values, bound the artifact to 64 KiB, and retain it for 14 days.
• Document the artifact and draft-autofix safety boundary.

Why

Hypervibe autofix can watch external deployment workflows, but it previously received only a failed SHA because generated deploy workflows did not publish diagnostic evidence. That made deploy repair unreliable.

Impact

Projects can declare hypervibe-deploy-failure.log as external-workflow evidence. Autofix still cannot edit deployment, infrastructure, auth, secret, billing, or database-schema paths, and it only opens a draft pull request for explicit human review.

Verification

• npx vitest run src/domain/services/__tests__/deployment-contract-workflow.test.ts src/domain/services/__tests__/github-ops.service.test.ts
• npm run typecheck