ci: make update deploys image-only by default

[Cataldir]

Summary

• make update entrypoints reuse existing infrastructure and skip �zd provision by default
• make APIM sync and smoke checks explicit via orceApimSync=true instead of a routine update side effect
• limit Foundry model deployment to explicit reconciliation runs while keeping image build and rollout paths intact
• update the deployment runbook and infrastructure governance docs to reflect the new image-only update policy

Validation

• verified workflow files with get_errors and found no editor errors in the edited YAML files
• git diff --check
• branch push completed through the repository pre-push lint and test gates

Notes

• lib fan-out remains intact: lib/ changes still redeploy CRUD plus all agent services
• CRUD-first rollout ordering remains unchanged in this PR; image builds remain parallel and agent deploys remain parallel within their matrix

Closes #733