fix(ci): gate build and deploy behind a committed .deploy-enabled marker

Every push to main since the first substituted commit was red at "Update
image tag in infra repo": sed: can't read k3s/apps/spatial-agent-app/
deployment.yaml. mathias/infra has no such manifest and the repo is a
hello-world MVP that should not deploy yet.

Port of doodle 32acff8/006c108/3a95cc9: guard outputs deploy_enabled from
scripts/deploy-enabled.sh (regular file, not symlink); build and deploy
require it to equal 'true', so a missing output fails closed. check and the
template guard are unchanged. No marker is committed.

Wiring test seen red on the old cd.yml (no gate), green after; removing the
clause from build.if or deploy.if makes it fail.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SZkhi49hfeSqBp5aZJNXsM

scripts/deploy-enabled.sh

@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+# Has this repo opted in to build and deploy?
+#
+# Prints "true" or "false". cd.yml's guard job reads it; build and deploy run
+# only when it says true (#3). Opt in by committing a regular file named
+# .deploy-enabled -- after the infra manifest (k3s/apps/spatial-agent-app) exists, not before.
+#
+# The marker must be a regular file and NOT a symlink. `[ -f ]` follows
+# symlinks, so it alone would say true for a link to any regular file.
+#
+# A missing directory exits 2 with nothing on stdout. Answering "false" there
+# would make a typo in the workflow look like a deliberate opt-out.
+set -euo pipefail
+
+dir="${1:-.}"
+
+if [ ! -d "$dir" ]; then
+  echo "deploy-enabled: no such directory: $dir" >&2
+  exit 2
+fi
+
+marker="$dir/.deploy-enabled"
+if [ -f "$marker" ] && [ ! -L "$marker" ]; then
+  echo "true"
+else
+  echo "false"
+fi