ci(deploy): require explicit release enablement

.gitea/workflows/ci.yml

@@ -46,7 +46,10 @@ jobs:
   build-and-deploy:
     name: Build immutable images and deploy
     needs: verify
-    if: gitea.event_name == 'push' && gitea.ref == 'refs/heads/main'
+    if: >-
+      gitea.event_name == 'push' &&
+      gitea.ref == 'refs/heads/main' &&
+      vars.DEPLOY_ENABLED == 'true'
     runs-on: ubuntu-latest
     timeout-minutes: 45
     steps:

README.md

@@ -237,7 +237,8 @@ kubectl kustomize k8s/ >/dev/null
 
 ### Gitea Actions release
 
-`.gitea/workflows/ci.yml` verifies every push and pull request. A successful
+`.gitea/workflows/ci.yml` verifies every push and pull request. After the
+repository variable `DEPLOY_ENABLED` is explicitly set to `true`, a successful
 push to `main` builds multi-architecture images at:
 
 ```text