fix(cd): skip image deploy for metadata-only runtime fixes [metadata-only]

.gitea/workflows/cd.yaml

@@ -1045,7 +1045,10 @@ jobs:
   build-and-deploy:
     # 2026-06-28 Codex: keep CD-generated `[skip ci]` deploy commits and
     # `cancel-stale-cd` queue-cleaning commits from re-entering build/deploy.
-    if: ${{ github.event_name != 'push' || (!contains(github.event.head_commit.message, '[skip ci]') && !contains(github.event.head_commit.message, 'cancel-stale-cd')) }}
+    # 2026-07-01 Codex: metadata-only controlled-runtime fixes already run the
+    # focused tests above; do not spend the Docker build lock or deploy marker
+    # when no app image can change.
+    if: ${{ github.event_name != 'push' || (!contains(github.event.head_commit.message, '[skip ci]') && !contains(github.event.head_commit.message, 'cancel-stale-cd') && !contains(github.event.head_commit.message, '[metadata-only]')) }}
     # 2026-04-30 Codex: Docker builds run on the host runner. Long docker build
     # steps were killing the transient act job container with RWLayer=nil.
     needs: [tests]
@@ -2237,7 +2240,9 @@ jobs:
   post-deploy-checks:
     # 2026-06-28 Codex: post-deploy checks belong to real deploy runs; skip
     # marker/no-op commits already accounted for by the previous deploy run.
-    if: ${{ github.event_name != 'push' || (!contains(github.event.head_commit.message, '[skip ci]') && !contains(github.event.head_commit.message, 'cancel-stale-cd')) }}
+    # 2026-07-01 Codex: `[metadata-only]` commits do not roll a new image, so
+    # post-deploy smokes would only retest the previous production artifact.
+    if: ${{ github.event_name != 'push' || (!contains(github.event.head_commit.message, '[skip ci]') && !contains(github.event.head_commit.message, 'cancel-stale-cd') && !contains(github.event.head_commit.message, '[metadata-only]')) }}
     needs: [build-and-deploy]
     timeout-minutes: 30
     # 2026-04-30 Codex: keep post-deploy on the host runner too. Playwright

ops/runner/test_cd_controlled_runtime_profile.py

@@ -782,6 +782,19 @@ def test_controlled_runtime_skips_b5_before_docker_socket_use() -> None:
     assert controlled_gate < exit_zero < docker_socket
 
 
+def test_metadata_only_marker_skips_deploy_jobs_after_tests() -> None:
+    text = _workflow_text()
+    tests_header = text.split("tests:", 1)[1].split("steps:", 1)[0]
+    build_header = text.split("build-and-deploy:", 1)[1].split("steps:", 1)[0]
+    post_deploy_header = text.split("post-deploy-checks:", 1)[1].split("steps:", 1)[0]
+
+    metadata_gate = "contains(github.event.head_commit.message, '[metadata-only]')"
+    assert metadata_gate not in tests_header
+    assert metadata_gate in build_header
+    assert metadata_gate in post_deploy_header
+    assert "metadata-only controlled-runtime fixes already run the" in text
+
+
 def test_b5_full_profile_fails_fast_when_docker_socket_or_db_network_is_unready() -> None:
     text = _workflow_text()
     b5_block = text.split("- name: Integration Tests (B5", 1)[1]