ci: deploy web only on releases or manually

.github/workflows/app.yml

@@ -2,11 +2,8 @@ name: Deploy app
 
 on:
   push:
-    branches: [master]
-    paths-ignore:
-      - 'packages/docs/**'
-      - 'openspec/**'
-      - '*.md'
+    tags:
+      - "v*"
   workflow_dispatch:
 
 jobs:
@@ -29,4 +26,4 @@ jobs:
         with:
           apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
-          command: pages deploy dist --project-name=openpencil-app
+          command: pages deploy dist --project-name=openpencil-app --branch=master

.github/workflows/docs.yml

@@ -2,9 +2,8 @@ name: Deploy docs
 
 on:
   push:
-    branches: [master]
-    paths:
-      - 'packages/docs/**'
+    tags:
+      - "v*"
   workflow_dispatch:
 
 jobs:
@@ -24,4 +23,4 @@ jobs:
         with:
           apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
-          command: pages deploy packages/docs/.vitepress/dist --project-name=openpencil-docs
+          command: pages deploy packages/docs/.vitepress/dist --project-name=openpencil-docs --branch=master

AGENTS.md

@@ -72,12 +72,15 @@ The app editor session (`src/app/editor/session/create.ts`) is a Vue wrapper aro
    - Builds Tauri binaries for macOS (arm64 + x64), Windows (x64 + arm64), Linux (x64)
    - Creates a draft GitHub Release with all platform binaries
    - Publishes public workspace packages to npm with provenance. Keep the exact package list in sync with `.github/workflows/build.yml`.
-7. Go to GitHub Releases → edit the draft → paste changelog section → publish
+7. The production web app/docs deploy workflows (`app.yml`, `docs.yml`) also trigger on `v*` tags. They do **not** deploy on ordinary `master` pushes.
+8. Go to GitHub Releases → edit the draft → paste changelog section → publish
 
 ### CI workflows
 
 Key workflows live in `.github/workflows/`. Use `build.yml` as the source of truth for release packaging and npm publishing, `ci.yml` / `heavy-tests.yml` for validation gates, and `app.yml` / `docs.yml` for Cloudflare Pages deploys.
 
+Production Cloudflare Pages deploys are intentionally release/manual only: `app.yml` and `docs.yml` run on `v*` tags and `workflow_dispatch`, not on `master` pushes. To deploy manually, run the relevant workflow from GitHub Actions (`Deploy app` or `Deploy docs`) on the desired ref; the workflow deploys to the configured production branch (`master`).
+
 ## Documentation
 
 - `CHANGELOG.md` — all user-facing changes, grouped by version. "Unreleased" section at top for in-progress work.