fix: repair gitea deploy pipeline

README.md

@@ -7,7 +7,7 @@ adapter-backed agent runtime, not a dependency of the frontend or domain model.
 > Backend-Brücke und Gateway-Integration geprüft. Siehe
 > [`docs/architecture-board-first-orchestration.md`](docs/architecture-board-first-orchestration.md)
 
-> CI runs automatically on every push. CD can run **automatically after successful CI**
+> CI runs automatically on every push. CD runs **inside the green CI run**
 > on main or can be triggered **manually** (workflow_dispatch). Deploy reads
 > `VERSION` but does not mutate Git or create tags. Rollback and database backup
 > are separate manual workflows.
@@ -351,20 +351,21 @@ Every push to `main` triggers `.gitea/workflows/ci.yaml`:
 
 CI must never break. If it does, Reviewer fixes.
 
-### CD — Auto + Manual (CD v3)
+### CD — Auto + Manual (CD v4)
 
 Deployment can happen automatically or manually:
 
-#### Auto-Deploy (after successful CI on main)
+#### Auto-Deploy (after successful CI jobs on main)
 
-- Triggered by `workflow_run` after `CI - Build & Test` succeeds on `main`
+- Runs as the final `Deploy Nexus` job in `.gitea/workflows/ci.yaml`
+- Starts only after backend, frontend, and security jobs succeed on `main`
 - Deploys the current `main` version after CI succeeds.
-- Skips automatically if the triggering commit contains `[skip ci]`
-- The deploy workflow reads `VERSION`; it does not mutate Git, bump versions, or create tags
+- This replaces `workflow_run`, which did not create deploy runs in this Gitea 1.26.3 installation.
+- The deploy script reads `VERSION`; it does not mutate Git, bump versions, or create tags
 
 #### Manual Deploy (`workflow_dispatch`)
 
-1. DevOps triggers `Deploy Nexus v2` in Gitea Actions
+1. DevOps triggers `Deploy Nexus Manual` in Gitea Actions
 2. Workflow validates `VERSION`, builds and deploys `main`
 3. Health check + smoke test verify the deployment