chore(ci): switch deploy.yml to manual workflow_dispatch with required chart_ref

Removes auto-deploy-on-PR-merge trigger and the old PR-merge gate. Deploy now
triggers only via workflow_dispatch, with chart_ref required (no default) as
the literal sientia-helm-chart branch bumped and deployed — hard error if it
doesn't exist, no silent fallback to development/main.

- .github/workflows/deploy.yml: drop pull_request trigger, add chart_ref
  input, branch_name now github.ref_name, drop pull-requests:read permission
- Delete .github/workflows/require-chart-ref-label.yml
- README.md: update Deploy section to describe manual trigger

[skip ci]

README.md

@@ -813,7 +813,9 @@ Runs automatically on each Pull Request to `main`:
 - ✅ Automatic version calculation based on branch pattern
 
 #### Deploy (`.github/workflows/deploy.yml`)
-Runs automatically when a PR is merged to `main`:
+Triggered manually via `workflow_dispatch`, with a required `chart_ref` input (no
+default — the sientia-helm-chart branch to bump and deploy; a branch that doesn't
+exist is a hard error, not a silent fallback):
 - ✅ Builds and pushes Docker image to Azure Container Registry
 - ✅ Creates GitHub release with calculated version
 - ✅ Deploys to Kubernetes using Helm