fix(ci): gate the three ungated pipelines on their own variable

A manual pipeline creation instantiates every pipeline in .crow/, so one whose
only manual condition is a bare `event: manual` fires on any manual trigger in
this repo. auto-apply-patches, weekly-patch-proposals and trial-build-registry
were in that state and all ran unintentionally alongside a manual
process-updates run.

- gate each on a variable named after the pipeline, defaulting to 'false', as
  repair-built-stamp.yaml documents and the other pipelines already do
- refresh the stale run-manually comments, which still referenced a `task`
  variable that no pipeline evaluates

.crow/auto-apply-patches.yaml

@@ -9,14 +9,27 @@
 # FORGEJO_TOKEN is used for both the branch push and opening the PR (no separate
 # write-scoped secret needed). Register the `auto-apply-patches` cron in the crow
 # UI, or run manually:
-#   woodpecker-cli pipeline create --var task=auto-apply-patches --branch=main 7
+#   crow pipeline create --branch main \
+#     --var auto_apply_patches=true devxy/build-cran-binaries
+#
+# The gate variable is `auto_apply_patches`, named after the pipeline: a manual
+# run instantiates every pipeline in `.crow/`, so one without its own gate runs
+# on *any* manual trigger in this repo. This one pushes a branch and opens a PR,
+# so it must stay off unless it is what was asked for.
 variables:
+  auto_apply_patches:
+    description: 'Run the auto-patch proposer. Also gates this pipeline.'
+    options:
+      - 'true'
+      - 'false'
+    default: 'false'
   patch_limit:
     description: 'Max candidates to propose per run (top by failure volume).'
     default: '10'
 
 when:
   - event: manual
+    evaluate: 'auto_apply_patches == "true"'
   - event: cron
     cron: auto-apply-patches