ci: disable deploy-hanzo job (incompatible with Bitnami Helm chart)

Production redis uses bitnami/redis via Helm chart. The hanzoai/kv
image has a different entrypoint and is not a drop-in replacement.
Build+push to GHCR still works. Deploy will be re-enabled once K8s
manifests are migrated to use hanzoai/kv natively.

.github/workflows/deploy.yml

@@ -123,47 +123,10 @@ jobs:
           cache-from: type=gha,scope=kv
           cache-to: type=gha,mode=max,scope=kv
 
-  deploy-hanzo:
-    needs: build
-    if: github.ref == 'refs/heads/main'
-    runs-on: ubuntu-latest
-    steps:
-      - name: Fetch deploy secrets from Hanzo KMS
-        id: kms
-        env:
-          KMS_CLIENT_ID: ${{ secrets.KMS_CLIENT_ID }}
-          KMS_CLIENT_SECRET: ${{ secrets.KMS_CLIENT_SECRET }}
-        run: |
-          set -euo pipefail
-          KMS_URL="${KMS_URL:-https://kms.hanzo.ai}"
-
-          ACCESS_TOKEN="$(
-            curl -fsS -X POST "${KMS_URL}/api/v1/auth/universal-auth/login" \
-              -H "Content-Type: application/json" \
-              -d "$(jq -nc --arg cid "$KMS_CLIENT_ID" --arg cs "$KMS_CLIENT_SECRET" \
-                    '{clientId: $cid, clientSecret: $cs}')" \
-            | jq -r '.accessToken'
-          )"
-
-          DO_TOKEN="$(
-            curl -fsS "${KMS_URL}/api/v3/secrets/raw/DIGITALOCEAN_ACCESS_TOKEN?workspaceSlug=gitops&environment=prod&secretPath=/ci&viewSecretValue=true&include_imports=true" \
-              -H "Authorization: Bearer ${ACCESS_TOKEN}" \
-            | jq -r '.secret.secretValue'
-          )"
-
-          echo "::add-mask::${DO_TOKEN}"
-          echo "do_token=${DO_TOKEN}" >> "$GITHUB_OUTPUT"
-
-      - name: Install doctl
-        uses: digitalocean/action-doctl@v2
-        with:
-          token: ${{ steps.kms.outputs.do_token }}
-
-      - name: Configure kubectl (hanzo-k8s)
-        run: doctl kubernetes cluster kubeconfig save hanzo-k8s
-
-      - name: Rolling update KV
-        run: |
-          kubectl -n hanzo set image statefulset/redis-master \
-            redis=ghcr.io/hanzoai/kv:latest
-          kubectl -n hanzo rollout status statefulset/redis-master --timeout=120s
+  # NOTE: deploy-hanzo disabled — production redis uses Bitnami Helm chart
+  # which is incompatible with hanzoai/kv image. Re-enable once K8s manifests
+  # are migrated to use ghcr.io/hanzoai/kv natively.
+  # deploy-hanzo:
+  #   needs: build
+  #   if: github.ref == 'refs/heads/main'
+  #   ...