docs: clarify release deployment process and enable manual deploy trigger

- Add workflow_dispatch to deploy.yml for manual deployment triggers
- Document that releases don't auto-deploy to production
- Add instructions for deploying releases to production
- Add verification steps for deployment

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

internal/auth/blocks.go

@@ -6,4 +6,4 @@ var BlockedNamespaces = []string{
 	// Add blocked namespaces here, e.g.:
 	// "io.github.spammer",
 	// "com.evil-domain",
-}
+}

internal/auth/jwt_test.go

@@ -300,9 +300,9 @@ func TestJWTManager_BlockedNamespaces(t *testing.T) {
 		originalBlocked := auth.BlockedNamespaces
 		auth.BlockedNamespaces = []string{"io.github.spammer"}
 		defer func() { auth.BlockedNamespaces = originalBlocked }()
-		
+
 		jwtManager := auth.NewJWTManager(cfg)
-		
+
 		claims := auth.JWTClaims{
 			AuthMethod:        auth.MethodGitHubAT,
 			AuthMethodSubject: "spammer",
@@ -325,9 +325,9 @@ func TestJWTManager_BlockedNamespaces(t *testing.T) {
 		originalBlocked := auth.BlockedNamespaces
 		auth.BlockedNamespaces = []string{"io.github.spammer"}
 		defer func() { auth.BlockedNamespaces = originalBlocked }()
-		
+
 		jwtManager := auth.NewJWTManager(cfg)
-		
+
 		claims := auth.JWTClaims{
 			AuthMethod:        auth.MethodGitHubAT,
 			AuthMethodSubject: "gooduser",
@@ -349,9 +349,9 @@ func TestJWTManager_BlockedNamespaces(t *testing.T) {
 		originalBlocked := auth.BlockedNamespaces
 		auth.BlockedNamespaces = []string{"io.github.badorg"}
 		defer func() { auth.BlockedNamespaces = originalBlocked }()
-		
+
 		jwtManager := auth.NewJWTManager(cfg)
-		
+
 		claims := auth.JWTClaims{
 			AuthMethod:        auth.MethodGitHubAT,
 			AuthMethodSubject: "user",
@@ -378,9 +378,9 @@ func TestJWTManager_BlockedNamespaces(t *testing.T) {
 		originalBlocked := auth.BlockedNamespaces
 		auth.BlockedNamespaces = []string{"io.github.spammer"}
 		defer func() { auth.BlockedNamespaces = originalBlocked }()
-		
+
 		jwtManager := auth.NewJWTManager(cfg)
-		
+
 		claims := auth.JWTClaims{
 			AuthMethod:        auth.MethodNone,
 			AuthMethodSubject: "admin",

internal/auth/types.go

@@ -16,4 +16,4 @@ const (
 	MethodHTTP Method = "http"
 	// No authentication - should only be used for local development and testing
 	MethodNone Method = "none"
-)
+)