chore(quick-260317-l9s): restrict CI/CD to tag-push-only trigger

- Remove branch push triggers (main, develop) from on.push
- Remove pull_request trigger entirely
- Simplify all job if-conditions (no longer need ref/event checks)
- Update stale comments to reflect tag-only trigger

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: claude

.github/workflows/ci-deploy.yml

@@ -2,18 +2,15 @@ name: CI/CD
 
 on:
   push:
-    branches: [main, develop]
     tags:
       - 'v*'
-  pull_request:
-    branches: [main, develop]
 
 permissions:
   contents: write
 
 jobs:
   # ============================================
-  # CI Jobs - Run on all pushes and PRs
+  # CI Jobs - Run on tag push
   # ============================================
 
   lint-and-typecheck:
@@ -47,7 +44,7 @@ jobs:
   build-apk:
     runs-on: ubuntu-latest
     needs: [lint-and-typecheck]
-    if: (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v')) && github.event_name == 'push' && needs.lint-and-typecheck.result == 'success'
+    if: needs.lint-and-typecheck.result == 'success'
     outputs:
       version: ${{ steps.version.outputs.version }}
     steps:
@@ -132,7 +129,7 @@ jobs:
   create-release:
     runs-on: ubuntu-latest
     needs: [build-apk]
-    if: (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v')) && github.event_name == 'push' && needs.build-apk.result == 'success'
+    if: needs.build-apk.result == 'success'
     steps:
       - name: Download APK artifact
         uses: actions/download-artifact@v4
@@ -158,13 +155,13 @@ jobs:
           prerelease: false
 
   # ============================================
-  # Deploy Jobs - Only on push to main
+  # Deploy Jobs - Run on tag push
   # ============================================
 
   deploy-landing:
     runs-on: ubuntu-latest
     needs: [lint-and-typecheck]
-    if: (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v')) && github.event_name == 'push' && needs.lint-and-typecheck.result == 'success'
+    if: needs.lint-and-typecheck.result == 'success'
     steps:
       - uses: actions/checkout@v4
         with:
@@ -205,7 +202,7 @@ jobs:
   deploy-deck-builder:
     runs-on: ubuntu-latest
     needs: [lint-and-typecheck]
-    if: (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v')) && github.event_name == 'push' && needs.lint-and-typecheck.result == 'success'
+    if: needs.lint-and-typecheck.result == 'success'
     steps:
       - uses: actions/checkout@v4
         with:
@@ -268,7 +265,7 @@ jobs:
   deploy-migrations:
     runs-on: ubuntu-latest
     needs: [lint-and-typecheck]
-    if: (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v')) && github.event_name == 'push' && needs.lint-and-typecheck.result == 'success'
+    if: needs.lint-and-typecheck.result == 'success'
     steps:
       - uses: actions/checkout@v4
         with:
@@ -309,7 +306,7 @@ jobs:
   deploy-functions:
     runs-on: ubuntu-latest
     needs: [lint-and-typecheck]
-    if: (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v')) && github.event_name == 'push' && needs.lint-and-typecheck.result == 'success'
+    if: needs.lint-and-typecheck.result == 'success'
     steps:
       - uses: actions/checkout@v4
         with: