deploy.yaml (main push only): - Pull image by SHA tag (already pushed during PR CI) - Tag as :latest and push - No rebuild needed
