Split build/deploy allowing deploy from external PRs

[kasbah]

Deploy is now triggered by workflow_run of the build and thus will be run even on PRs from external contributors.

[jmoggr]

1. I'm very nervous about having other peoples code run in our CI, how certain are we that they can't exfiltrate secrets? For example could they open a PR with changes to our github actions which then run?

2. This looks rather complicated and it seems that there is more going on then the PR title indicates. Github actions are a nightmare to debug, so I would lean towards keeping them as simple as possible.

[kasbah]

Those are fair concerns @jmoggr.

1. • As before, the running of any of our actions is dependant on manual approval for first-time PR creators. The new "deploy" workflow is triggered by running of the "build" workflow which needs the manual approval.
   • The "deploy" workflow is run in context of our main branch rather than the PR branch. A PRs modifying the "deploy" workflow does not affect any actions run until it is merged.
   • Coming to think of it, we can improve our security posture by making a "production" GH environment that always requires maintainer approval for access, no matter what.

2. I don't disagree with keeping our CI as simple as possible but I do want these quality of life improvements such as the nicer inline deploy notifications (a big part of the complexity -- but this is already on main) and getting deploy previews for external contributions. Happy for any suggestions to simplify any of this.