terrateamio/terrateam#1397 ADD promote-v1 workflow to auto-move v1 tag on push to main

[joshpollara]

Automates v1 releases so we no longer need a manual "PR main -> v1" step.

• Adds promote-v1.yaml: on every push to main, moves the v1 tag to main and builds/pushes ghcr.io/terrateamio/action:v1.
• Deletes ci.yaml (superseded; it built the image on push to the v1 branch).

v1 becomes a moving tag instead of a branch. Tags aren't subject to branch protection, so the default GITHUB_TOKEN can move it — no PAT needed.

Order of operations (post-merge cutover)

Run these once, after this PR merges to main and the promote-v1 workflow has run (that first run creates the v1 tag).

# 1. Confirm the v1 tag exists and points at main (the two SHAs must match)
git fetch --tags --force origin
git ls-remote origin refs/tags/v1 refs/heads/main

# 2. Remove v1 branch protection (allow_deletions is currently false,
#    so the branch delete is blocked until this is removed)
gh api -X DELETE repos/terrateamio/action/branches/v1/protection

# 3. Delete the v1 branch so @v1 resolves to the tag
git push origin --delete v1

# 4. Verify @v1 resolves ONLY to the tag (should print no refs/heads/v1 line)
git ls-remote origin refs/tags/v1 refs/heads/v1

Safety check: in step 1, if the SHAs don't match, the workflow didn't run or the tag push failed — stop and check the Actions tab. Deleting the branch while the tag is missing would break @v1 for everyone.

After cutover, every merge to main moves v1 forward automatically.

Closes stategraph/stategraph#1397