Add external facing gql-ws for agent websockets

[michaeljguarino]

This has a more stable, usable websocket client (hopefully), so should be a better solve for delivering these pushes into our agents

Fixes PROD-4699 PROD-4700

Test Plan

unit test

Checklist

• If required, I have updated the Plural documentation accordingly.
• I have added tests to cover my changes.
• I have added a meaningful title and summary to convey the impact of this PR to a user.

Plural Flow: console

[greptile-apps]

Greptile Summary

This PR introduces an external-facing graphql-transport-ws WebSocket endpoint (/ext/socket/gql-ws) for agent communication, backed by a new ExternalGraphqlWSSocket that authenticates via deploy token. It adds a deploy_agent_notification GQL subscription that pushes resource notifications scoped to the authenticated cluster, wired into the existing PubSub broadcast pipeline.

The only notable concern is that event_to_resource uses a prefix match on \"service\" <> _, which means \"service.manifests\" events (manifest-fetch requests) are forwarded to the subscription as :service notifications alongside genuine \"service.event\" updates.

Confidence Score: 5/5

Safe to merge — the only finding is a P2 concern about an overly broad prefix match that may or may not be intentional.

Auth is correctly enforced via deploy token and cluster context. The new socket, schema subscription, and broadcast integration all follow existing patterns faithfully. The one open question (service.manifests matching) is a logic style issue that doesn't break the primary use case.

lib/console/deployments/pubsub/consumers/broadcast.ex — verify whether service.manifests events should be forwarded as :service notifications.

Important Files Changed

Filename	Overview
lib/console/deployments/pubsub/consumers/broadcast.ex	Adds do_gql_broadcast to fan out cluster room events to Absinthe subscriptions; event_to_resource pattern could unintentionally forward service.manifests events as :service notifications.
lib/console/external_graphql.ex	Adds subscription block importing public_deployment_subscriptions to the external-facing GraphQL schema.
lib/console/graphql/deployments.ex	Adds agent_notification_resource enum, deploy_agent_notification object, and public_deployment_subscriptions with cluster-auth config; types and auth logic look correct.
lib/console_web/channels/graphqlws_socket.ex	Adds ExternalGraphqlWSSocket authenticated via deploy token; mirrors existing GraphqlWSSocket pattern correctly.
lib/console_web/endpoint.ex	Registers the new ExternalGraphqlWSSocket at /ext/socket/gql-ws with graphql-transport-ws subprotocol; no path conflict with existing /ext/socket route.

_{Reviews (1): Last reviewed commit: "Add external facing gql-ws for agent web..." | Re-trigger Greptile}

[linear]

PROD-4699 frontend doesn't seem to be subscribing to workbenchJob subscription events

PROD-4700 workbench job result + activity result metrics are now on the fly tool calls