Require tests before manual deploy

[keithataylor]

Summary

• Add a pre-deploy gate to the manual ECS deploy workflow
• Grant the deploy workflow checks: read permission so it can inspect commit check runs
• Fail deployment early unless the required test check has passed for the exact commit SHA being deployed
• Keep the existing SHA-tagged Docker image build/push and ECS deployment flow unchanged

Why

This prevents a manual deploy from running against a commit whose CI tests have failed, have not run, or are still pending.

Verified

• git diff --check
• Workflow change is limited to .github/workflows/deploy.yml