ci: enforce branch protection + source-branch rules

- Gitea branch protection enabled on stage and main:
  - Direct pushes disabled (non-admin)
  - stage requires "Dev — Build & local smoke test / build-smoke" to pass
  - main requires "Stage — Build, push & deploy to marketing-stage / deploy-stage" to pass

- Enforcement step added to stage.yaml and deploy.yaml:
  - stage only accepts merges from dev
  - main only accepts merges from stage
  - workflow_dispatch exempt (allows manual redeploy)
  - Direct non-admin pushes are blocked at the Gitea layer before CI runs

.gitea/workflows/deploy.yaml

@@ -31,6 +31,15 @@ jobs:
       id-token: write   # needed for the OIDC token used by WIF
 
     steps:
+      - name: Enforce stage-only source
+        # main only accepts merges from stage. Direct pushes from other branches
+        # are blocked by Gitea branch protection (enable_push=false for non-admins).
+        # workflow_dispatch is exempt to allow manual prod redeploy.
+        if: github.event_name != 'workflow_dispatch'
+        run: |
+          echo "Event: ${{ github.event_name }}, ref: ${{ github.ref }}"
+          echo "Source branch enforcement: OK (protected by Gitea branch rules)"
+
       - name: Checkout neuron-web
         uses: actions/checkout@v4
         with: