fix: guard manual Woodpecker pipelines with evaluate conditions

When GHA triggers a manual pipeline for issue automation, ALL pipelines
with event:manual fire. Added evaluate conditions:
- issue-automation.yml: only runs when ISSUE_NUMBER is set
- provision-user.yml: only runs when ISSUE_NUMBER is NOT set
- build-ci-image.yml: only runs when ISSUE_NUMBER is NOT set

This prevents build-ci-image from failing on missing registry_password
secret when issue automation triggers.

[ci skip]

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.woodpecker/build-ci-image.yml

@@ -2,10 +2,11 @@
 # Triggers on changes to ci/Dockerfile or manual dispatch.
 
 when:
-  event: [push, manual]
+  - event: [push, manual]
-  branch: master
+    branch: master
-  path:
+    evaluate: 'CI_PIPELINE_VARIABLE_ISSUE_NUMBER == ""'
-    include:
+    path:
+      include:
       - 'ci/Dockerfile'
 
 steps:

.woodpecker/issue-automation.yml

@@ -1,5 +1,6 @@
 when:
-  event: manual
+  - event: manual
+    evaluate: 'CI_PIPELINE_VARIABLE_ISSUE_NUMBER != ""'
 
 clone:
   git:

.woodpecker/provision-user.yml

@@ -1,5 +1,6 @@
 when:
-  event: manual
+  - event: manual
+    evaluate: 'CI_PIPELINE_VARIABLE_ISSUE_NUMBER == ""'
 
 clone:
   git: