fix(ci): replace workflow_run triggers with push+paths (Gitea 1.22.6)

Three workflows used `workflow_run:` to trigger when
`publish-workspace-server-image.yml` completed, but Gitea 1.22.6
does not support the `workflow_run` event (task #81). The workflows
were silently dead — never firing despite `continue-on-error: true`.

Replaced each with `push: branches: [X], paths: [.gitea/workflows/
publish-workspace-server-image.yml]` which fires on every commit to
the publish workflow. This is functionally equivalent: only successful
runs commit to the branch.

Also:
- `redeploy-tenants-on-staging.yml`: corrected branch from [main] to
  [staging] (was wrong in the original Gitea port).
- `staging-verify.yml`: removed `if: workflow_run.conclusion==success`
  since push events lack this context; the smoke test itself is the
  safety net.
- Added `workflow_dispatch` to all three for manual runs.

This fixes the 3 Rule-2 violations reported by lint-workflow-yaml
(lint from #671).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.gitea/workflows/redeploy-tenants-on-main.yml

@@ -9,12 +9,11 @@ name: redeploy-tenants-on-main
 #   - Workflow-level env.GITHUB_SERVER_URL pinned per
 #     feedback_act_runner_github_server_url.
 #   - `continue-on-error: true` on each job (RFC §1 contract).
-#   - **Gitea workflow_run trigger limitation**: Gitea 1.22.6's support
-#     for the `workflow_run` event is partial. If this never fires on a
-#     real publish-workspace-server-image completion, the follow-up
-#     triage PR should replace the trigger with a push-with-paths-filter
-#     on .gitea/workflows/publish-workspace-server-image.yml. Until
-#     then continue-on-error+dead-workflow doesn't break anything.
+#   - ~~**Gitea workflow_run trigger limitation**~~ FIXED: replaced with
+#     push+paths filter per this PR. Gitea 1.22.6 does not support
+#     `workflow_run` (task #81). The push trigger fires on every
+#     commit to publish-workspace-server-image.yml which is the
+#     same signal (only successful runs commit to main).
 #
 
 # Auto-refresh prod tenant EC2s after every main merge.
@@ -50,10 +49,11 @@ name: redeploy-tenants-on-main
 # target_tag=<sha>, re-pulling the older image on every tenant.
 
 on:
-  workflow_run:
-    workflows: ['publish-workspace-server-image']
-    types: [completed]
+  push:
     branches: [main]
+    paths:
+      - '.gitea/workflows/publish-workspace-server-image.yml'
+  workflow_dispatch:
 permissions:
   contents: read
   # No write scopes needed — the workflow hits an external CP endpoint,

.gitea/workflows/redeploy-tenants-on-staging.yml

@@ -9,12 +9,13 @@ name: redeploy-tenants-on-staging
 #   - Workflow-level env.GITHUB_SERVER_URL pinned per
 #     feedback_act_runner_github_server_url.
 #   - `continue-on-error: true` on each job (RFC §1 contract).
-#   - **Gitea workflow_run trigger limitation**: Gitea 1.22.6's support
-#     for the `workflow_run` event is partial. If this never fires on a
-#     real publish-workspace-server-image completion, the follow-up
-#     triage PR should replace the trigger with a push-with-paths-filter
-#     on .gitea/workflows/publish-workspace-server-image.yml. Until
-#     then continue-on-error+dead-workflow doesn't break anything.
+#   - ~~**Gitea workflow_run trigger limitation**~~ FIXED: replaced with
+#     push+paths filter per this PR. Gitea 1.22.6 does not support
+#     `workflow_run` (task #81). The push trigger fires on every
+#     commit to publish-workspace-server-image.yml which is the
+#     same signal (only successful runs commit to main). Removed
+#     `workflow_run.conclusion==success` job if since push implies
+#     the workflow completed and committed.
 #
 
 # Auto-refresh staging tenant EC2s after every staging-branch merge.
@@ -50,10 +51,11 @@ name: redeploy-tenants-on-staging
 # of a known-good build.
 
 on:
-  workflow_run:
-    workflows: ['publish-workspace-server-image']
-    types: [completed]
-    branches: [main]
+  push:
+    branches: [staging]
+    paths:
+      - '.gitea/workflows/publish-workspace-server-image.yml'
+  workflow_dispatch:
 permissions:
   contents: read
   # No write scopes needed — the workflow hits an external CP endpoint,
@@ -72,12 +74,6 @@ env:
 
 jobs:
   redeploy:
-    # Skip the auto-trigger if publish-workspace-server-image didn't
-    # actually succeed. workflow_run fires on any completion state; we
-    # don't want to redeploy against a half-built image.
-    # NOTE (Gitea port): workflow_dispatch trigger dropped; only the
-    # workflow_run path remains.
-    if: ${{ github.event.workflow_run.conclusion == 'success' }}
     runs-on: ubuntu-latest
     # Phase 3 (RFC #219 §1): surface broken workflows without blocking.
     continue-on-error: true

.gitea/workflows/staging-verify.yml

@@ -11,11 +11,14 @@ name: Staging verify
 #   - Workflow-level env.GITHUB_SERVER_URL pinned per
 #     feedback_act_runner_github_server_url.
 #   - `continue-on-error: true` on each job (RFC §1 contract).
-#   - **Gitea workflow_run trigger limitation**: Gitea 1.22.6's support
-#     for the `workflow_run` event is partial. If this never fires on a
-#     real publish-workspace-server-image completion, the follow-up
-#     triage PR should replace the trigger with a push-with-paths-filter
-#     on the same publish workflow's path (i.e. `.gitea/workflows/publish-workspace-server-image.yml`).
+#   - ~~**Gitea workflow_run trigger limitation**~~ FIXED: replaced with
+#     push+paths filter per this PR. Gitea 1.22.6 does not support
+#     `workflow_run` (task #81). The push trigger fires on every
+#     commit to publish-workspace-server-image.yml. Removed the
+#     `workflow_run.conclusion==success` job if since the push trigger
+#     doesn't carry completion state — the smoke test is the safety net
+#     (it will detect and abort on a bad image regardless). Added
+#     workflow_dispatch for manual runs.
 #
 
 # Runs the canary smoke suite against the staging canary tenant fleet
@@ -59,9 +62,11 @@ name: Staging verify
 #     are populated.
 
 on:
-  workflow_run:
-    workflows: ["publish-workspace-server-image"]
-    types: [completed]
+  push:
+    branches: [staging]
+    paths:
+      - '.gitea/workflows/publish-workspace-server-image.yml'
+  workflow_dispatch:
 permissions:
   contents: read
   packages: write
@@ -78,10 +83,6 @@ env:
 
 jobs:
   staging-smoke:
-    # Skip when the upstream workflow failed — no image to test against.
-    # workflow_dispatch trigger dropped in this Gitea port; only the
-    # workflow_run path remains.
-    if: ${{ github.event.workflow_run.conclusion == 'success' }}
     runs-on: ubuntu-latest
     # Phase 3 (RFC #219 §1): surface broken workflows without blocking.
     continue-on-error: true