fix(ci): make production deploy manual only

.gitea/workflows/deploy-prod.yml

@@ -1,9 +1,6 @@
 name: Deploy to Production
 
 on:
-  workflow_run:
-    workflows: ["Prepare Release"]
-    types: [completed]
   workflow_dispatch:
     inputs:
       release:
@@ -25,7 +22,7 @@ env:
 jobs:
   deploy:
     name: Deploy to Production
-    if: ${{ github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success' }}
+    if: ${{ github.event_name == 'workflow_dispatch' }}
     runs-on: ubuntu-latest
     timeout-minutes: 30
     outputs:
@@ -94,30 +91,17 @@ jobs:
 
       - name: Validate Release Chain
         run: |
-          if [ "${{ github.event_name }}" = "workflow_run" ]; then
-            EXPECTED_SHA="${{ github.event.workflow_run.head_sha }}"
-            RELEASE_TAG="${{ steps.fetch.outputs.tag }}"
-            RELEASE_SHA="${RELEASE_TAG##*.}"
-            EXPECTED_SHA_SHORT="${EXPECTED_SHA:0:${#RELEASE_SHA}}"
-
-            if [ "$EXPECTED_SHA_SHORT" != "$RELEASE_SHA" ]; then
-              echo "ERROR: Release SHA does not match upstream workflow SHA"
-              echo "Expected: $EXPECTED_SHA"
-              echo "Expected short: $EXPECTED_SHA_SHORT"
-              echo "Release:  $RELEASE_SHA"
-              exit 1
-            fi
-
-            echo "✓ Release chain verified: $EXPECTED_SHA_SHORT"
-          else
-            echo "✓ Workflow dispatch mode — release chain verification skipped"
-          fi
+          RELEASE_TAG="${{ steps.fetch.outputs.tag }}"
+          RELEASE_SHA="${RELEASE_TAG##*.}"
+          echo "✓ Workflow dispatch mode — release chain verification is manual"
+          echo "  Selected release: $RELEASE_TAG"
+          echo "  Extracted commit suffix: $RELEASE_SHA"
 
       - name: Validate Upstream CI Success
         env:
           GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
           REPO: ${{ env.REPO }}
-          EXPECTED_SHA: ${{ github.event.workflow_run.head_sha }}
+          EXPECTED_SHA: ${{ steps.fetch.outputs.commit }}
         run: |
           python3 - <<'PY'
           import json
@@ -129,8 +113,8 @@ jobs:
           repo = os.environ["REPO"]
           expected_sha = os.environ.get("EXPECTED_SHA", "")
           if not expected_sha:
-              print("✓ Workflow dispatch mode — upstream CI validation skipped")
-              sys.exit(0)
+              print("ERROR: missing expected release commit")
+              sys.exit(1)
 
           matched_ci = None
           for page in range(1, 6):