feat(deploy): AUTODEPLOY kill-switch via repo variable

Set AUTODEPLOY=false under Settings -> Actions -> Variables and pushes stop deploying with no commit; unset means on. Manual Run workflow always bypasses the switch. The existing needs/skipped chaining propagates the skip through verify and smoke untouched.

.gitea/workflows/deploy.yaml

@@ -39,10 +39,15 @@ env:
 
 jobs:
   preflight:
+    # Kill-switch for autodeploy: set the AUTODEPLOY repo variable to 'false'
+    # (Settings -> Actions -> Variables) and pushes stop reaching the cluster
+    # with no commit. Unset means on. A manual Run workflow always bypasses
+    # the switch: dispatching it is the explicit intent to deploy.
     if: >-
-      github.event_name != 'workflow_run' ||
+      (vars.AUTODEPLOY != 'false' || github.event_name == 'workflow_dispatch') &&
+      (github.event_name != 'workflow_run' ||
       (github.event.workflow_run.conclusion == 'success' &&
-       github.event.workflow_run.head_branch == 'main')
+       github.event.workflow_run.head_branch == 'main'))
     runs-on: [self-hosted, linux, arch, homelab, prod]
     timeout-minutes: 10
     steps: