ci: publish images from every green push to main

The release job enforced the production source preflight, which blocks while
the payment and messaging adapters are fake. They still are, by design, so
since 2026-09-23 no release could succeed and production kept running older
images while main moved on.

Pushes to main that pass validation, the integration suite and the scans now
build, scan and publish the images. Nothing is deployed automatically:
production changes when the stack is pulled and redeployed in Portainer. A
manual run also calls the Portainer webhook when one is configured. The
preflight stays in the scan job, advisory unless ENFORCE_PRODUCTION_PREFLIGHT
is true, in which case a blocked preflight stops publishing.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.gitea/workflows/deploy.yml

@@ -134,9 +134,9 @@ jobs:
             fs --scanners secret --exit-code 1 --severity HIGH,CRITICAL \
             --no-progress /src
 
-      # Keep push feedback advisory while the provider adapters are fake.
-      # The manual release job enforces the source preflight unconditionally.
-      # ENFORCE_PRODUCTION_PREFLIGHT can make push checks fail on blockers too.
+      # Advisory while the provider adapters are fake. This is the only copy of
+      # the gate: set ENFORCE_PRODUCTION_PREFLIGHT=true and a blocked preflight
+      # fails this job, which stops images from being published.
       - name: Production source preflight
         run: |
           set +e
@@ -153,10 +153,14 @@ jobs:
           fi
           echo "::warning::Source preflight reports blockers (advisory; set ENFORCE_PRODUCTION_PREFLIGHT=true to gate)."
 
+  # Every push to main that passes validation, the integration suite and the
+  # scans publishes images. Production changes only when someone pulls and
+  # redeploys the stack in Portainer; a manual run of this workflow also calls
+  # the Portainer webhook when one is configured.
   publish-and-deploy:
-    name: Publish images and notify Portainer
+    name: Publish images
     needs: [validate, integration, scan]
-    if: gitea.event_name == 'workflow_dispatch' && gitea.ref == 'refs/heads/main'
+    if: gitea.ref == 'refs/heads/main' && (gitea.event_name == 'push' || gitea.event_name == 'workflow_dispatch')
     runs-on: ubuntu-latest
     timeout-minutes: 45
     env:
@@ -166,12 +170,6 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
-      - name: Require production readiness
-        env:
-          PORTAINER_WEBHOOK: ${{ secrets.PORTAINER_WEBHOOK }}
-        run: |
-          python3 deploy/production_preflight.py --source-only
-          test -n "$PORTAINER_WEBHOOK"
       - name: Sign in to the Gitea Container Registry
         env:
           REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
@@ -236,7 +234,12 @@ jobs:
           done
 
       - name: Trigger Portainer redeployment
+        if: gitea.event_name == 'workflow_dispatch'
         env:
           PORTAINER_WEBHOOK: ${{ secrets.PORTAINER_WEBHOOK }}
         run: |
+          if [ -z "$PORTAINER_WEBHOOK" ]; then
+            echo "No PORTAINER_WEBHOOK configured; redeploy the stack in Portainer."
+            exit 0
+          fi
           curl --fail --silent --show-error --max-time 30 --request POST "$PORTAINER_WEBHOOK"