Push-triggered deployment workflow

## Goal
Convert the `deploy.yml` workflow from `workflow_dispatch`-only to also trigger on every push. Each branch gets its own isolated Amplify sandbox stack, and re-pushing to the same branch updates it in place.

## Acceptance criteria
- Pushing a new branch creates a CloudFormation stack named `amplify---*`
- Re-pushing to the same branch updates the stack (not a new stack)
- Two branches can be deployed simultaneously without collision (concurrency group per branch already exists)
- `workflow_dispatch` trigger is kept for manual deploys

## Dependencies
- Milestone 1: Unified Deployment (PR #30) must be merged first so one `ampx sandbox --once` call deploys everything

## Notes
- Branch name sanitization (replacing `/` with `-`, etc.) is already implemented in `scripts/build.sh` — reuse that logic in the workflow
- The concurrency group `group: deploy-${{ github.ref }}` should prevent parallel runs on the same branch

---
*Imported from `waltmayf/agentcore-amplify-fullstack`#31 — originally filed by @waltmayf on 2026-07-02. Migrated to open-source repo; cross-references updated post-import.*

Review deploy.yml and scripts/build.sh first, then confirm that PR #30 is merged and inspect the existing concurrency group. Update the workflow so push and workflow_dispatch both deploy through the documented path, reusing branch sanitization; done means per-branch stacks are created or updated without collisions.

Written by the indexing model from the issue text.