ci(delta-gate): add a push fallback trigger alongside workflow_dispatch

workflow_dispatch needs Actions-unit write on the dispatching credential;
push does not, since Forgejo runs the workflow straight from the pushed
ref's tree. A plain push to a rel/** or ci/** branch now also fires the
gate, resolving candidate to the pushed commit and control to the last
released, known-good tip (10.4.9) when the workflow_dispatch inputs
aren't present.

.forgejo/workflows/delta-gate.yml

@@ -27,6 +27,12 @@ on:
         description: 'Control sha to diff against'
         required: true
         type: string
+  # workflow_dispatch needs Actions-unit write on the dispatching credential;
+  # push does not (it runs from the pushed ref's own tree), so a plain push
+  # to a release or CI branch is the fallback trigger while that grant is
+  # outstanding — see the ref-resolution step below for what it gates against.
+  push:
+    branches: ['rel/**', 'ci/**']
 
 concurrency:
   group: delta-gate
@@ -38,6 +44,21 @@ jobs:
     runs-on: gate-functional
     timeout-minutes: 120
     steps:
+      - name: Resolve candidate/control refs
+        id: refs
+        run: |
+          candidate="${{ github.event.inputs.candidate }}"
+          control="${{ github.event.inputs.control }}"
+          # workflow_dispatch supplies both explicitly; a push event carries
+          # neither — fall back to the pushed commit as candidate and the
+          # last released, known-good tip (10.4.9) as control, so a plain
+          # push still produces a meaningful gate instead of an empty ref.
+          if [ -z "$candidate" ]; then candidate="${{ github.sha }}"; fi
+          if [ -z "$control" ]; then control="eec90bdd"; fi
+          echo "candidate=$candidate" >> "$GITHUB_OUTPUT"
+          echo "control=$control" >> "$GITHUB_OUTPUT"
+          echo "Resolved (trigger=${{ github.event_name }}): candidate=$candidate control=$control"
+
       - name: Clean any residue from a prior run
         run: rm -rf "ob-cand-${{ github.run_id }}" "ob-ctrl-${{ github.run_id }}" "/tmp/ob-${{ github.run_id }}-"*
 
@@ -47,7 +68,7 @@ jobs:
           set -o pipefail
           git clone --quiet "https://source.soulcraft.com/soulcraftlabs/open-brainy.git" "ob-cand-${{ github.run_id }}"
           cd "ob-cand-${{ github.run_id }}"
-          git checkout --quiet "${{ github.event.inputs.candidate }}"
+          git checkout --quiet "${{ steps.refs.outputs.candidate }}"
           git log --oneline -1
           bun install
           rc=0
@@ -63,7 +84,7 @@ jobs:
           set -o pipefail
           git clone --quiet "https://source.soulcraft.com/soulcraftlabs/open-brainy.git" "ob-ctrl-${{ github.run_id }}"
           cd "ob-ctrl-${{ github.run_id }}"
-          git checkout --quiet "${{ github.event.inputs.control }}"
+          git checkout --quiet "${{ steps.refs.outputs.control }}"
           git log --oneline -1
           bun install
           rc=0