ci: make AWS deploy manual (workflow_dispatch), not on-push

The deploy workflow needs AWS + Xe secrets that aren't set on a fresh clone, so
it failed on every push. Gated to on-demand; CI (build+tests) still runs on push.

Author: CedricConday

.github/workflows/deploy.yml

@@ -1,11 +1,10 @@
 name: Deploy to AWS
 
+# Manual-only: AWS deploy runs on demand (needs AWS_* + XE_* repo secrets),
+# not on every push. Keeps the CD pipeline as a documented artifact without
+# failing builds when cloud credentials aren't configured.
 on:
-  push:
-    branches: [main]
-    paths-ignore:
-      - "**.md"
-      - "examples/**"
+  workflow_dispatch:
 
 jobs:
   deploy: