Deploy playground through AWS OIDC

[alixander]

What changed

• grant the production deploy job contents: read and id-token: write
• assume the new d2lang-playground-deploy AWS role through GitHub OIDC
• point deploys at the D2-owned S3 bucket and CloudFront distribution with committed, non-secret workflow environment values
• remove the static AWS key and deploy-target secret inputs

Why

Playground deployments need to target the new D2-owned AWS infrastructure without retaining long-lived AWS credentials in GitHub.

Impact

This only changes deployment authentication and destination configuration. It does not change TALA or other playground source code, merge the change, or alter DNS.

Validation

• parsed .github/workflows/deploy.yml successfully as YAML
• git diff --check
• confirmed the diff contains only .github/workflows/deploy.yml
• confirmed static AWS credential inputs and secret-backed deploy target references are absent