Gate manual SAP deploys on successful CI for the target commit

[Copilot]

deploy-sap was triggered automatically from ci. This changes the workflow to manual-only and adds an explicit gate so SAP deployment can run only for main when the selected commit already has a successful ci run.

• Trigger model

  • Replace workflow_run with workflow_dispatch
  • Stop automatic SAP deployment after every successful CI completion

• Deployment gate

  • Add a verify-ci job ahead of deployment
  • Fail early unless the workflow is run for main
  • Query GitHub Actions runs for ci.yml and require a successful push run for the exact HEAD commit being deployed

• Workflow permissions

  • Grant read access to Actions metadata so the gate can inspect prior workflow runs

on:
  workflow_dispatch:

jobs:
  verify-ci:
    steps:
      - uses: actions/github-script@v8
        with:
          script: |
            const run = runs.find((candidate) =>
              candidate.head_sha === context.sha && candidate.event === 'push');

            if (!run || run.conclusion !== 'success') {
              core.setFailed('No successful ci run found for this commit.');
            }

  deploy-sap:
    needs: verify-ci