fix(ci): gate Deploy/report on actual failure

The Report step in the deploy workflow's report job was running
unconditionally (only the JOB had `if: always() && !cancelled()`,
not the step), so api.diag.ci fired on every successful Deploy run
and auto-filed a fake "ci/Deploy/report failed" issue. Closes #404,
#405, #406 (false positives).

Add `if: contains(needs.*.result, 'failure')` to the Report step.
Matches the `if: failure()` pattern already on every other workflow's
report step (ci.yml, harden.yml, infra-ci.yml, etc).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.gitea/workflows/deploy.yml

@@ -258,6 +258,10 @@ jobs:
           UV_INSTALL_DIR: /usr/local/bin
 
       - name: Report
+        # Only file an issue if at least one upstream build job failed.
+        # Without this gate api.diag.ci runs unconditionally and files
+        # a fake "failed" issue on every successful Deploy run.
+        if: contains(needs.*.result, 'failure')
         env:
           GITEA_TOKEN: ${{ secrets.DEPLOY_TOKEN }}
         run: |