fix(ci): gate build and deploy behind a committed .deploy-enabled marker

Every push to main since the first substituted commit was red at "Update
image tag in infra repo": sed: can't read k3s/apps/spatial-agent-app/
deployment.yaml. mathias/infra has no such manifest and the repo is a
hello-world MVP that should not deploy yet.

Port of doodle 32acff8/006c108/3a95cc9: guard outputs deploy_enabled from
scripts/deploy-enabled.sh (regular file, not symlink); build and deploy
require it to equal 'true', so a missing output fails closed. check and the
template guard are unchanged. No marker is committed.

Wiring test seen red on the old cd.yml (no gate), green after; removing the
clause from build.if or deploy.if makes it fail.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SZkhi49hfeSqBp5aZJNXsM

Taskfile.yml

@@ -27,6 +27,9 @@ tasks:
       # The template guard decides whether CI runs at all in every child repo,
       # so its regression test belongs in the same gate as the Go tests.
       - bash scripts/tests/is-template_test.sh
+      # Decide whether build and deploy run at all; same reasoning.
+      - bash scripts/tests/deploy-enabled_test.sh
+      - bash scripts/tests/cd-wiring_test.sh
       # The three Go commands above cannot see cmd/spatial-agent-app -- Go's
       # ./... expansion skips directories whose names start with an underscore.
       # This gates the substituted result, which is what a child actually runs.