feat(BUY-65234): deploy guards patch for ops merge

[BuyWhere]

Summary

Adds if: github.ref != 'refs/heads/main' guards to all remaining production dispatch workflows. On 2026-07-29, agents dispatched Deploy-site-to-production from 3 feature branches that were 53 commits behind main, shipping stale builds that 410'd all 10 BUY-64967 blog posts. Ops merged the first guard to deploy-site-production.yml directly; this PR covers the rest.

⚠️ Merge Note

This PR contains one file: BUY-65234-workflow-guards.patch with the exact guard diff. A maintainer with a workflow-scope token must apply this patch, because the agent's PAT lacks workflow scope (GitHub blocks .github/workflows/* changes).

git fetch origin fix/BUY-65234-deploy-guards-patch
git checkout fix/BUY-65234-deploy-guards-patch  
git am --directory=. BUY-65234-workflow-guards.patch
git push origin fix/BUY-65234-deploy-guards-patch:main

Files to Guard (in the patch)

• .github/workflows/deploy-api-production.yml
• .github/workflows/deploy-railway.yml
• .github/workflows/deploy-nginx-production.yml
• .github/workflows/deploy-www.yml
• .github/workflows/deploy-mcp-railway.yml

Each gets:

- name: Refuse non-main refs (BUY-65234)
  if: github.ref != 'refs/heads/main'
  run: |
    echo "::error::PRODUCTION DEPLOYS MUST COME FROM main. You dispatched from '${github.ref}'."
    echo "::error::Deploying a feature branch to production ships a stale build."
    echo "::error::Merge your branch to main first; pushes to main auto-deploy."
    exit 1

Already merged to main

• AGENTS.md — fleet-wide deploy policy
• deploy-site-production.yml — Ops guard (commit a96f4d1)

Fixes: BUY-65234