Create a continuous delivery job to deploy to production

As the Tardis infrastructure now supports the creation of Kubernetes Service Accounts, let's introduce a continuous delivery pipeline so that I (kilo) don't have to SSH into the production environment after every merge to update the deployment.

The new deployment pipeline runs for commits on protected branches, and will use the masked CI variables for the Kubernetes endpoint and long-lived service account auth token to restart a deployment.