fix: use GH_PAT for GHCR push on forked repo

GITHUB_TOKEN lacks packages:write on forks. Use org-level
GH_PAT secret instead. Also trigger on master branch (the
actual default).

Author: hanzo-dev

.github/workflows/deploy.yml

@@ -2,7 +2,7 @@ name: Build and Deploy Hanzo SQL
 
 on:
   push:
-    branches: [main]
+    branches: [main, master]
     tags: ['v*']
     paths:
       - 'Dockerfile'
@@ -64,7 +64,7 @@ jobs:
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
+          password: ${{ secrets.GH_PAT }}
 
       - name: Log in to Docker Hub
         uses: docker/login-action@v3
@@ -103,7 +103,7 @@ jobs:
 
   deploy-hanzo:
     needs: build
-    if: github.ref == 'refs/heads/main'
+    if: github.ref == 'refs/heads/main' || github.ref == 'refs/heads/master'
     runs-on: ubuntu-latest
     steps:
       - name: Fetch deploy secrets from Hanzo KMS