ci: auto-deploy on push (owned-app model) — no more manual kubectl set image

Adopt the documented owned-app deploy model (infra CLAUDE.md, ref
tuya_bridge/.woodpecker.yml): build.yml now tags the image with the
8-char commit SHA (alongside :latest) and adds a `deploy` step that
`kubectl set image`s the deployment to that SHA tag + waits for rollout.
A unique SHA tag forces a fresh pull under the deployment's
imagePullPolicy: IfNotPresent (a re-pushed :latest would not). The
woodpecker-agent SA is cluster-admin so the in-cluster kubectl needs no
kubeconfig; Keel stays enrolled as a redundant net.

Also stop deploy.yml firing on push: it's a manual-only targeted-deploy
tool now. Its IMAGE_TAG-absent exit-78 used to mark the whole push
pipeline red (build.yml + deploy.yml are workflows in one pipeline run),
masking real build/deploy status.

Removes the manual deploy step the recall fix required.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.woodpecker/deploy.yml

@@ -1,5 +1,9 @@
+# Manual-only targeted deploy of a specific tag (set IMAGE_NAME + IMAGE_TAG).
+# Push-driven deploys are handled by build.yml's deploy step now; this no longer
+# fires on push (its IMAGE_TAG-absent exit-78 used to red every push pipeline,
+# since build.yml + deploy.yml are workflows in the same pipeline run).
 when:
-  - event: [manual, push]
+  - event: manual
 
 steps:
   - name: check-vars