Auto-run prisma migrate deploy on merge to main

Discovered post-OPER-7A merge: Vercel build script does not invoke `prisma migrate deploy`, so merged migrations do NOT auto-apply to production. OPER-7A migration had to be applied manually via Neon connector.

Required:
1. Add `pnpm --filter @operant/database prisma migrate deploy` to the Vercel build pipeline (either in package.json build step or as a Vercel build command override)
2. Guard with `NODE_ENV=production` and DATABASE_URL check to avoid running in preview branches unintentionally
3. Ensure Neon preview branches (via neon-branch.yml) get their own migrate deploy for PR previews
4. Add a post-deploy verification step: query _prisma_migrations to confirm latest migration_name matches head migration file in the repo; fail deploy if mismatch
5. Runbook update: `docs/operations/deploy-migrations.md` explaining the deploy-time migration model + manual override path for emergency

Risk: without this, every future migration ships silently broken to prod until someone notices missing tables. Same class of silent-failure bug OPER-7A is designed to catch.