ci: platform-prod-secrets is dispatch-only
Follow-up to #32470. Its one push run (41491005815) put CLOUD_FREESTYLE_API_KEY on cmux-platform-production and skipped JWT_PRIVATE_JWK and CLOUD_LINK_SIGNING_KEYS, which cmux-next-production holds no copy of. This drops the push trigger so nothing runs it again by itself; it stays dispatchable for when those production copies are placed in the environment.
It also notes the #32470 review follow-up (gpt-6.1-sol: the list-then-put check is not atomic) in the file's header: don't dispatch it while anyone else is putting these secrets. With no push trigger it only runs by hand, which covers that follow-up.
Agent session: agent session
🤖 Generated with Claude Code
![Autofix with [code]smith](https://pr-comments-assets.blacksmith.sh/codesmith/autofix-with-codesmith-dark-3x.png)
Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.
Summary by cubic
Makes platform-prod-secrets.yml dispatch-only so it no longer runs on push. The single push run from #32470 put CLOUD_FREESTYLE_API_KEY on cmux-platform-production and skipped JWT_PRIVATE_JWK and CLOUD_LINK_SIGNING_KEYS, which cmux-next-production holds no copy of. It stays runnable by hand once those production copies are placed in the environment. The header now also warns that the list-then-put check is not atomic, so avoid dispatching it while anyone else is setting these secrets.