chore(deploy): fetch infra PR token from Vault, match sentinel PR format

[BK1031]

• Fetch the infrastructure PR token from Vault at runtime via Gaucho-Racing/vault-pull-secrets@v1 instead of the INFRA_PR_TOKEN repo secret
• Add the Click here to view all changes compare link to the generated PR body
• Attribute the deploy commit to @gauchoracing rather than github-actions[bot]

Brings deploy.yml in line with Sentinel's, which already made all three changes (Sentinel #100, #101).

Why now

The v3.9.7 deploy run failed at Checkout infrastructure with Input required and not supplied: token — INFRA_PR_TOKEN does not exist as a repo secret or an org secret. It existed for v3.9.6 in June, so the PAT most likely expired and the secret was removed. Sourcing from Vault removes the recurring expiry problem rather than re-adding a secret that will lapse again.

Requires a Vault rule before this works

vault-pull-secrets authorizes on repository, Git ref, and requested selector. A GitHub Actions rule in Vault settings has to allow Gaucho-Racing/Mapache to read infrastructure.pr_token — the Sentinel rule does not cover this repo. Without it the Pull secrets step fails and the run stops there, same as it does today.

Notes

• Selector infrastructure.pr_token maps to PR_TOKEN per the action's naming (app prefix dropped, field uppercased), read via fromJSON(steps.vault.outputs.secrets_json).PR_TOKEN.
• id-token: write added to the job so the runner can mint the OIDC token.
• KUSTOMIZATION keeps the repo-relative form from the previous PR rather than Sentinel's infra/-prefixed variable. Sentinel still hardcodes the bare path a second time in its diff step, which is how its two copies drifted apart; keeping one source avoids that.