chore(ci): switch deploy.yml to manual workflow_dispatch with required chart_ref

Removes auto-deploy-on-PR-merge trigger and the old PR-merge gate. Deploy now
triggers only via workflow_dispatch, with chart_ref required (no default) as
the literal sientia-helm-chart branch bumped and deployed — hard error if it
doesn't exist, no silent fallback to development/main.

- .github/workflows/deploy.yml: drop pull_request trigger, add chart_ref
  input, branch_name now github.ref_name, drop pull-requests:read permission
- Delete .github/workflows/require-chart-ref-label.yml
- README.md: update Deploy section to describe manual trigger

[skip ci]

.github/workflows/deploy.yml

@@ -1,23 +1,27 @@
 name: Deploy DataOps Worker
 
 on:
-  pull_request:
-    types: [closed]
-    branches: [main, 'release/**', 'feature/**']
   workflow_dispatch:
+    inputs:
+      chart_ref:
+        description: >
+          sientia-helm-chart branch to bump GITHUB_BRANCH on AND deploy — the literal
+          deploy target. Validated via git ls-remote; a branch that does not exist in
+          sientia-helm-chart is a hard error, not a silent fallback to main.
+        required: true
+        type: string
 
 permissions:
   contents: write
   id-token: write
-  pull-requests: read
 
 jobs:
   deploy:
     name: Deploy
-    if: github.event_name == 'workflow_dispatch' || github.event.pull_request.merged == true
     uses: Aignosi/github_workflow_templates/.github/workflows/reusable-deploy-dataops.yml@main
     with:
-      branch_name: ${{ github.event.pull_request.head.ref }}
+      branch_name: ${{ github.ref_name }}
+      chart_ref: ${{ inputs.chart_ref }}
       project_name: 'model-manager'
       chart_name: 'model-manager'
       env_list_path: '[".global.env"]'

.github/workflows/require-chart-ref-label.yml

@@ -1,16 +0,0 @@
-name: Require chart-ref label
-
-on:
-  pull_request:
-    types: [opened, synchronize, reopened, labeled, unlabeled]
-    branches:
-      - main
-      - 'release/**'
-      - 'feature/**'
-
-permissions:
-  pull-requests: write
-
-jobs:
-  require-chart-ref-label:
-    uses: Aignosi/github_workflow_templates/.github/workflows/require-chart-ref-label.yml@main

README.md

@@ -813,7 +813,9 @@ Runs automatically on each Pull Request to `main`:
 - ✅ Automatic version calculation based on branch pattern
 
 #### Deploy (`.github/workflows/deploy.yml`)
-Runs automatically when a PR is merged to `main`:
+Triggered manually via `workflow_dispatch`, with a required `chart_ref` input (no
+default — the sientia-helm-chart branch to bump and deploy; a branch that doesn't
+exist is a hard error, not a silent fallback):
 - ✅ Builds and pushes Docker image to Azure Container Registry
 - ✅ Creates GitHub release with calculated version
 - ✅ Deploys to Kubernetes using Helm