task(docs): guide basic GitHub Actions CI/CD setup

[rspurgeon]

Help users and agents starting from this repository find the complete GitHub Actions quickstart for a Dev Portal and an API with an inline OpenAPI specification. Link it from the README and declarative guide, and align the bundled skill with PR diffs and inline apply on main.

Correct the unsupported plan -o json guidance and replace incomplete sync-script examples with the basic workflow. Saved-plan workflows remain documented for explicit artifact-review requests.

Merge dependency: publish Kong/developer.konghq.com#7230 before merging this PR, so the new documentation links resolve.

Validation: make format produced no changes, make lint reported zero issues, make test passed with the race detector (including a rerun after the portal example update), and skill/whitespace validation passed. The companion quickstart also passed a targeted site build, both Vale passes, workflow/ShellCheck validation, and CLI diff/apply checks against a local API stub. No live Konnect resources were changed.

[kong-api-ops]

✅ KSAI Review: Finished

1. 17:19 UTC Reviewing changed code against project conventions

---

Run report (federated) · 1 paid run · $0.0345 total

#	Engine	Result	Model	Turns	Cost
1	opencode	success	zai-org/GLM-5.3-Flash/high	19	$0.0344

Reviewing cost $0.0344; deciding how to run it cost $0.0001

[kong-api-ops]

Check	Result
Scope	Docs-only change: README, declarative guide, agent skill, and CI/CD reference rewritten around a diff-on-PR/apply-on-main GitOps pattern
Mandate	default-code-reviewer
Findings	None
Findings audit	Skipped (no candidate findings)

All CLI claims in the new docs were checked against the code: plan rejects -o/--output and supports --output-file (internal/cmd/root/verbs/plan/plan.go:55, internal/cmd/root/products/konnect/declarative/declarative.go:926), diff accepts --plan, --mode, and -o text (declarative.go:1918-1955), apply accepts --plan, --auto-approve, -o (declarative.go:2571-2574), mode mismatch errors exist (declarative.go:2285), --region is a real flag (konnect.go:55), !secret/parts and write-only secret selection match the tags and flag code, and the loader's placeholder mode supports exposing OPENAI_API_KEY only to apply. The shell: bash pipefail advice matches GitHub's configured default. No additional concerns found.