refactor(cli): wmill sync git-deploy stops committing; caller owns commit+push (#9284)

Single contract for the deployment-callback path: the CLI does branch
checkout + pull, the caller (hub script in production, test in test)
does git add + commit + push. This restores the WIN-1974 invariant —
GPG setup and `git commit` run back-to-back in the same process, so
the agent's pre-warmed passphrase cache is still warm at sign time —
without needing a `--skip-commit` flag for the hub case and a default
"also-commit" for everything else. Same behavior in every call site.

Changes:
  - sync.ts: drop the gitSyncDeployPush call from pull()'s deploy path
    (both the onlyCreateBranch fast-return and the post-pull commit).
    `gitSyncDeployPush` stays exported for any caller that wants the
    same commit/push semantics — just not invoked by the CLI subcommand.
  - gitsync_promotion.test.ts: e2e test now does its own git add +
    commit + push after `wmill sync git-deploy`, mirroring what the
    hub script does in production. Same regression coverage
    (wm_deploy branch created in Case A, main untouched; main updated
    in Case B, no new wm_deploy).

CLI typecheck unchanged (two pre-existing TarAsZip errors at lines
2578/3307, present before this PR). All 743 unit tests still pass.

The accompanying hub script (option-C — CLI for branch+pull, script
for commit+push) lives at /tmp/git-sync-diff/sync-script-to-git-repo-windmill.option-C.ts.
Once published, a follow-up bumps LATEST_GIT_SYNC_SCRIPT_PATH to its id.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

cli/src/commands/sync/sync.ts

@@ -2503,14 +2503,8 @@ export async function pull(
     }
 
     if (opts.onlyCreateBranch) {
-      gitSyncDeployPush({
-        items: deployItems,
-        authorName: process.env["WM_USERNAME"] || "windmill",
-        authorEmail: process.env["WM_EMAIL"] || "windmill@windmill.dev",
-        committerName: opts.gitCommitterName,
-        committerEmail: opts.gitCommitterEmail,
-        onlyCreateBranch: true,
-      });
+      // Branch is checked out locally; the caller pushes it. Symmetric with
+      // the non-onlyCreateBranch path: CLI does branch + pull, never push.
       return;
     }
   }
@@ -2982,19 +2976,11 @@ export async function pull(
     log.warn(`Failed to pull shared UI folder: ${e}`);
   }
 
-  // Git-sync deployment-callback mode: commit the pulled files and push the
-  // current branch (the wm_deploy/fork branch checked out above, or the base
-  // branch in workspace-wide mode).
-  if (opts.gitDeployItems !== undefined && !opts.onlyCreateBranch) {
-    const deployItems: GitSyncDeployItem[] = JSON.parse(opts.gitDeployItems);
-    gitSyncDeployPush({
-      items: deployItems,
-      authorName: process.env["WM_USERNAME"] || "windmill",
-      authorEmail: process.env["WM_EMAIL"] || "windmill@windmill.dev",
-      committerName: opts.gitCommitterName,
-      committerEmail: opts.gitCommitterEmail,
-    });
-  }
+  // Git-sync deployment-callback mode stops here: branch checkout + pull have
+  // happened, but commit + push are the caller's job. The hub script does
+  // them in-process with `set_gpg_signing_secret` so the agent's pre-warmed
+  // passphrase cache is still warm at sign time (WIN-1974). `gitSyncDeployPush`
+  // stays exported for callers that want the same commit/push behavior.
 }
 
 // Internal git-sync deployment-callback entrypoint. Invoked only by the