infra(argo): disable push-triggered ci-pipeline — manual-only

Per user directive: pushes to main must not trigger any Argo compute
(not even the CPU-heavy test-gate). Changed the sensor's body.ref
filter value from "refs/heads/main" to a never-matching sentinel.
The eventsource still receives GitLab push webhooks; the sensor
evaluates them and rejects every one.

To re-enable: restore the value to "refs/heads/main" and
`kubectl apply -f infra/k8s/argo/events/ci-pipeline-sensor.yaml`.

Manual trigger paths (unchanged):
- ci-pipeline:        argo submit --from=wftmpl/ci-pipeline -p commit-sha=<SHA>
- compile-and-deploy: curl -X POST http://workflow-trigger-eventsource-svc.foxhunt:12001/compile-deploy \
                        -H 'Content-Type: application/json' -d '{"commit_sha": "<SHA>"}'

infra/k8s/argo/events/ci-pipeline-sensor.yaml

@@ -18,17 +18,24 @@ spec:
       eventName: gitlab-push
       filters:
         data:
+          # DISABLED per user directive: pushes must not trigger any compute.
+          # Filter requires a ref value that no real webhook will ever emit,
+          # so the sensor evaluates but always rejects. Ci-pipeline (including
+          # the expensive test-gate) now runs via manual `argo submit` only.
+          #
+          # To re-enable push-triggered CI: change the value back to
+          # "refs/heads/main" AND re-apply the sensor
+          # (`kubectl apply -f infra/k8s/argo/events/ci-pipeline-sensor.yaml`).
           - path: body.ref
             type: string
             value:
-              - "refs/heads/main"
-  # Auto-compile (compile-and-deploy) is available via the manual webhook:
-  #   curl -X POST http://workflow-trigger-eventsource-svc.foxhunt:12001/compile-deploy \
-  #     -H 'Content-Type: application/json' -d '{"commit_sha": "<SHA>"}'
-  # To enable auto-compile on every push to main, add a second trigger here
-  # that submits compile-and-deploy with the same checkout_sha.
-  # Toggle: kubectl -n foxhunt patch configmap auto-compile-config \
-  #   -p '{"data":{"enabled":"true"}}'
+              - "refs/heads/__push_ci_disabled_by_policy__"
+  # Manual triggers still work:
+  #   - ci-pipeline:        argo submit --from=wftmpl/ci-pipeline -p commit-sha=<SHA>
+  #   - compile-and-deploy: curl -X POST http://workflow-trigger-eventsource-svc.foxhunt:12001/compile-deploy \
+  #                           -H 'Content-Type: application/json' -d '{"commit_sha": "<SHA>"}'
+  # The auto-compile-config ConfigMap is a separate toggle for auto-compile on
+  # push to main; leave it at "false" to keep deploy manual as well.
 
   triggers:
     - template: