gate releases on k8s e2e test, remove per-push trigger

- test-k8s-deploy.yml: trigger on workflow_call and workflow_dispatch
  only (not every push/PR)
- publish.yml: add needs: e2e job that calls test-k8s-deploy.yml —
  release is blocked until the k8s e2e suite passes

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.github/workflows/publish.yml

@@ -7,8 +7,13 @@ on:
       - publish-test
 
 jobs:
+  e2e:
+    name: "Gate: k8s deploy e2e"
+    uses: ./.github/workflows/test-k8s-deploy.yml
+
   publish:
     name: "Build and publish"
+    needs: e2e
     runs-on: ubuntu-latest
     steps:
       - name: "Clone project repository"

.github/workflows/test-k8s-deploy.yml

@@ -1,10 +1,10 @@
 name: K8s Deploy Test
 
 on:
-  pull_request:
+  # Manual trigger for ad-hoc validation
-    branches: '*'
+  workflow_dispatch:
-  push:
+  # Called by publish workflow to gate releases
-    branches: '*'
+  workflow_call:
 
 jobs:
   test: