feat: emit GitHub Deployment objects and statuses for promotions

[joshua-temple]

Problem

cascade promotes a release through environments, but it never creates native GitHub
Deployment objects. As a result the repository Deployments timeline, environment URLs, and
the auto-inactive behavior that supersedes older deployments do not reflect cascade
promotions. Operators who expect a release orchestrator to populate the native Deployments
view see nothing there today.

Constraint

GitHub only auto-creates a Deployment object when a job carries a literal environment: key.
That key is forbidden on a job that calls a reusable workflow via uses:. Because every
cascade deploy is a reusable-workflow caller job, cascade cannot get native Deployment
objects "for free" through the callback. The Deployment objects have to be created
explicitly.

Proposed approach

Emit optional steps in cascade's own orchestration and promotion jobs, which do have a
steps: block, that call the GitHub Deployments API. Using gh api or
actions/github-script, these steps would:

• create a Deployment for the target environment,
• set the deployment status through in_progress, then success or failure,
• attach the environment URL when one is configured,
• rely on native auto-inactivation so a successful deployment supersedes prior ones for the
  same environment (with the option to keep prior ones active).

This is opt-in via a manifest field, off by default. An optional environment_url per
environment in the environment config feeds the status step.

Acceptance criteria

• A promotion to an environment produces a Deployment object visible in the repository
  Deployments view, with correct status transitions and an environment URL when configured.
• An e2e/ scenario exercises the generated steps and asserts the resulting Deployment and
  statuses.
• Documentation covers the manifest field and the generated steps.
• The work stays within the no-runtime-platform model: pure API calls from generated steps,
  stateless within the workflow run, with no controller or hosted responder.