Declare environment as an input on the reusable deploy workflow

[ShanaLMoore]

Summary

.github/workflows/deploy.yaml uses inputs.environment for the job's environment:, the ops values path, the helm release name and the namespace, but never declares it as an input.

That works today because every caller is workflow_dispatch with an input of that name. It stops working the moment a caller is triggered by push or workflow_run, neither of which has dispatch inputs to inherit. inputs.environment resolves empty, the job binds to no GitHub Environment, gets no environment secrets, and any required reviewer on that environment never fires. The deploy does not fail loudly, it runs unscoped.

Acceptance Criteria

• environment declared as an optional string input on both workflow_dispatch and workflow_call
• Existing callers keep working with no change, since the input is optional
• A tagged release cut after merge, because callers pin by tag
• At least one knapsack confirmed deploying to the correct GitHub Environment from a non-dispatch trigger

Notes

PR: #119

Blocks notch8/hykuup_knapsack#715 and notch8/utk_knapsack#19. Both call this reusable workflow rather than owning the deploy steps, so they cannot pass an environment until it is a declared input.

samvera/hyku is unaffected. Its deploy workflow is inline, which is why notch8/hyku-community-issues#147 could be solved without touching this repo.

This work had no ticket of its own and lives in a third repo, so it was invisible on the boards.