fix(ci): gate the three ungated pipelines on their own variable (#155)

## Problem

A manual `crow pipeline create` instantiates **every** pipeline in `.crow/`, and each one decides for itself whether to run. Three had nothing to decide with — their only manual condition was a bare `event: manual`:

- `auto-apply-patches` — pushes to `auto/registry-patch-proposals` and opens/updates a PR
- `weekly-patch-proposals` — posts and edits two Forgejo issues
- `trial-build-registry` — starts a build per matrix row, on both arches

So they fired on *any* manual trigger in this repo, whatever it was for. That is how they came to run alongside a manual `process-updates` run for `alpine-324-arm64` (#10723), which is also why that pipeline is marked failure.

`repair-built-stamp.yaml` already documents the rule this breaks:

> The gate variable is `repair_built_stamp`, not `target_arch` … Every pipeline here gates on a variable named after itself for exactly that reason.

## What this changes

Each of the three gets a gate variable named after the pipeline, `evaluate`d on the manual event, defaulting to off:

```yaml
variables:
  auto_apply_patches:
    description: 'Run the auto-patch proposer. Also gates this pipeline.'
    options: ['true', 'false']
    default: 'false'

when:
  - event: manual
    evaluate: 'auto_apply_patches == "true"'
  - event: cron
    cron: auto-apply-patches
```

Cron triggers are untouched, so the scheduled runs behave exactly as before.

The run-manually comments in all three headers were also stale: they documented `--var task=<name>` with `woodpecker-cli`, and no pipeline evaluates a `task` variable. They now show the real invocation.

## Note on the sibling pipelines

The already-gated pipelines use `default: all` (e.g. `weekly_rebuild_missing`). If Crow applies a declared default to a variable that an API-created pipeline never passed, those would match on an unrelated manual run too — `weekly-rebuild-missing` would be an expensive way to find out. I could not settle that from #10723 because its step logs have since expired, so I left them alone rather than guess. The three fixed here default to `'false'`, which is safe under either semantics.

## Verification

`crow lint .crow/` passes. Auditing every pipeline that accepts a manual event now reports a gate on all ten:

```
build-all-versions-install-deps.yaml: gated
auto-apply-patches.yaml: gated
weekly-patch-proposals.yaml: gated
weekly-audit-missing.yaml: gated
repair-built-stamp.yaml: gated
archive-missed-packages.yaml: gated
weekly-rebuild-missing.yaml: gated
trial-build-registry.yaml: gated
build-all-versions.yaml: gated
process-updates.yaml: gated
```

Reviewed-on: #155

.crow/auto-apply-patches.yaml

@@ -9,14 +9,27 @@
 # FORGEJO_TOKEN is used for both the branch push and opening the PR (no separate
 # write-scoped secret needed). Register the `auto-apply-patches` cron in the crow
 # UI, or run manually:
-#   woodpecker-cli pipeline create --var task=auto-apply-patches --branch=main 7
+#   crow pipeline create --branch main \
+#     --var auto_apply_patches=true devxy/build-cran-binaries
+#
+# The gate variable is `auto_apply_patches`, named after the pipeline: a manual
+# run instantiates every pipeline in `.crow/`, so one without its own gate runs
+# on *any* manual trigger in this repo. This one pushes a branch and opens a PR,
+# so it must stay off unless it is what was asked for.
 variables:
+  auto_apply_patches:
+    description: 'Run the auto-patch proposer. Also gates this pipeline.'
+    options:
+      - 'true'
+      - 'false'
+    default: 'false'
   patch_limit:
     description: 'Max candidates to propose per run (top by failure volume).'
     default: '10'
 
 when:
   - event: manual
+    evaluate: 'auto_apply_patches == "true"'
   - event: cron
     cron: auto-apply-patches
 

.crow/trial-build-registry.yaml

@@ -7,15 +7,27 @@
 #
 # The repo uses no `pull_request` triggers, so this runs manually against the
 # branch (or on a cron); point it at the auto-patch branch via `patch_branch`:
-#   woodpecker-cli pipeline create --var task=trial-build-registry \
-#     --var patch_branch=auto/registry-patch-proposals --branch=main 7
+#   crow pipeline create --branch main --var trial_build_registry=true \
+#     --var patch_branch=auto/registry-patch-proposals devxy/build-cran-binaries
+#
+# The gate variable is `trial_build_registry`, named after the pipeline: a
+# manual run instantiates every pipeline in `.crow/`, so one without its own
+# gate runs on *any* manual trigger in this repo. This one starts a build per
+# matrix row on both arches, which is far too expensive to fire by accident.
 variables:
+  trial_build_registry:
+    description: 'Trial-build the branch new registry entries. Also gates this pipeline.'
+    options:
+      - 'true'
+      - 'false'
+    default: 'false'
   patch_branch:
     description: 'Branch whose new registry entries to trial-build.'
     default: auto/registry-patch-proposals
 
 when:
   - event: manual
+    evaluate: 'trial_build_registry == "true"'
   - event: cron
     cron: trial-build-registry
 

.crow/weekly-patch-proposals.yaml

@@ -8,8 +8,26 @@
 # Global across platforms (the classifier groups over all of single_builds), so
 # a single job -- no matrix. Clones read-only; the only writes are the two
 # Forgejo issues via FORGEJO_TOKEN.
+#
+# Run manually with:
+#   crow pipeline create --branch main \
+#     --var weekly_patch_proposals=true devxy/build-cran-binaries
+#
+# The gate variable is `weekly_patch_proposals`, named after the pipeline: a
+# manual run instantiates every pipeline in `.crow/`, so one without its own
+# gate runs on *any* manual trigger in this repo. This one posts and edits
+# Forgejo issues, so an unrelated manual run must not fire it.
+variables:
+  weekly_patch_proposals:
+    description: 'Run the weekly failure triage. Also gates this pipeline.'
+    options:
+      - 'true'
+      - 'false'
+    default: 'false'
+
 when:
   - event: manual
+    evaluate: 'weekly_patch_proposals == "true"'
   - event: cron
     cron: weekly-patch-proposals