[ci] deploy.yml: manual-only — push events don't set IMAGE_TAG

.woodpecker/deploy.yml

@@ -1,5 +1,9 @@
 when:
-  - event: [manual, push]
+  # Manual-only — fired with IMAGE_TAG by the build pipeline (or
+  # by a human kicking off a deploy from the Woodpecker UI).
+  # The earlier `[manual, push]` would fire on every push and fail
+  # at check-vars because IMAGE_TAG is unset on push events.
+  - event: manual
 
 steps:
   - name: check-vars