fix(ci): sign bot commits and auto-update specs on build failure

Use the numeric user ID prefix in the github-actions[bot] email so
commits are verified (required by branch protection).

Make the update-vendored-specs workflow callable via workflow_call, and
invoke it from test-deploy when the build fails — so stale specs get
refreshed automatically without using the workflow_run trigger.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: marythought

.github/workflows/test-deploy.yaml

@@ -26,3 +26,8 @@ jobs:
         run: npm run build
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  update-vendored-specs:
+    needs: test-deploy
+    if: failure()
+    uses: ./.github/workflows/update-vendored-specs.yaml

.github/workflows/update-vendored-specs.yaml

@@ -2,6 +2,7 @@ name: Update vendored OpenAPI specs
 
 on:
   workflow_dispatch:
+  workflow_call:
 
 concurrency:
   group: update-vendored-specs
@@ -26,7 +27,7 @@ jobs:
       - name: Set up git identity
         run: |
           git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
 
       - name: Install dependencies
         run: npm ci