Aligns with cobalt-dingo reference — the deploy job was missing the Gitea Actions environment protection so staging approvals/secrets were not enforced.