fix: skip release and docker jobs on pull requests

Dependabot PRs were incorrectly triggering the docker build job.
Now release and docker jobs only run on pushes to main, scheduled
runs, and manual triggers.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

.github/workflows/deploy.yaml

@@ -59,6 +59,7 @@ jobs:
     name: Semantic Release
     runs-on: ubuntu-latest
     needs: [lint]
+    if: github.event_name != 'pull_request'
     outputs:
       published: ${{ steps.semrel.outputs.new_release_published }}
       version: ${{ steps.semrel.outputs.new_release_version }}
@@ -101,7 +102,7 @@ jobs:
   docker:
     name: Build and Push Docker Image
     needs: [release]
-    if: needs.release.result == 'success'
+    if: github.event_name != 'pull_request' && needs.release.result == 'success'
     runs-on: ubuntu-latest
     env:
       RELEASE_VERSION: ${{ needs.release.outputs.version }}