V3 Part 4: deploy.yml adopts the deploy contract #83

Part 4 of the V3 batch (the last part). Depends on a deploy contract template and a check-deploy-contract check that are not yet published where this repo can use them. Do not start until they are, with a named commit added here. Not agent-ready.

Why

deploy.yml already smoke-tests and rolls back on a failed deploy. This part puts it on the org's deploy contract so that behaviour is the standard one and is checked. setkernel-live deploys on every merge to main, and this is the deploy path itself.

Acceptance criteria

• .github/workflows/deploy.yml adopts the deploy contract template, with a smoke test and automatic rollback on every merge, and passes check-deploy-contract.
• npm run validate passes and the required visual-diff check passes on the head.

Files likely touched

.github/workflows/deploy.yml, test/workflows.test.mjs (only if the contract needs it), AGENTS.md (Deploy section).

Risk class

R3: it is the deploy workflow and every merge deploys live.setkernel.com. Raghav merges.