chore(ci): switch deploy.yml to manual workflow_dispatch with required chart_ref

Removes auto-deploy-on-PR-merge trigger and the old PR-merge gate. Deploy now
triggers only via workflow_dispatch, with chart_ref required (no default) as
the literal sientia-helm-chart branch bumped and deployed — hard error if it
doesn't exist, no silent fallback to development/main.

- .github/workflows/deploy.yml: drop pull_request trigger, add chart_ref
  input, branch_name now github.ref_name, drop pull-requests:read permission
- Delete .github/workflows/require-chart-ref-label.yml

[skip ci]

.github/workflows/deploy.yml

@@ -1,23 +1,27 @@
 name: Deploy DataOps Worker
 
 on:
-  pull_request:
-    types: [closed]
-    branches: [main, 'release/**', 'feature/**']
   workflow_dispatch:
+    inputs:
+      chart_ref:
+        description: >
+          sientia-helm-chart branch to bump GITHUB_BRANCH on AND deploy — the literal
+          deploy target. Validated via git ls-remote; a branch that does not exist in
+          sientia-helm-chart is a hard error, not a silent fallback to main.
+        required: true
+        type: string
 
 permissions:
   contents: write
   id-token: write
-  pull-requests: read
 
 jobs:
   deploy:
     name: Deploy
-    if: github.event_name == 'workflow_dispatch' || github.event.pull_request.merged == true
     uses: Aignosi/github_workflow_templates/.github/workflows/reusable-deploy-dataops.yml@main
     with:
-      branch_name: ${{ github.event.pull_request.head.ref }}
+      branch_name: ${{ github.ref_name }}
+      chart_ref: ${{ inputs.chart_ref }}
       project_name: 'ingestor'
       chart_name: 'opc-ingestor'
       env_list_path: '[".env"]'