fix: scope production action trigger guidance

deploy/README.md

@@ -120,7 +120,7 @@ The server has a persistent 2 GB `/swapfile`. UFW permits only SSH `22000/tcp`,
 
 ## Manual deployment with GitHub Actions
 
-Pushes and pull requests do not start GitHub Actions automatically. Run the required validation workflows from the Actions page, then manually start `.github/workflows/deploy-production.yml` for the tested branch. The deployment workflow syncs that revision with `rsync`, preserves `/opt/jyotisha-app/.env.production`, rebuilds both Docker services, and verifies the public login route, logged-out account response, and private Python health endpoint.
+Production pushes and pull requests do not start GitHub Actions automatically. Run the required validation workflows from the Actions page, then manually start `.github/workflows/deploy-production.yml` for the tested branch. The deployment workflow syncs that revision with `rsync`, preserves `/opt/jyotisha-app/.env.production`, rebuilds both Docker services, and verifies the public login route, logged-out account response, and private Python health endpoint.
 
 Required GitHub Actions secret:
 

frontend/tests/staging-backend-workflows.test.ts

@@ -243,6 +243,29 @@ function logicalShellLines(script: string): string[] {
     .filter(Boolean);
 }
 
+test("production manual-trigger wording is scoped and staging automation stays explicit", () => {
+  const readme = readFileSync(deploymentReadmeUrl, "utf8");
+  const production = markdownSection(
+    readme,
+    "## Manual deployment with GitHub Actions",
+  );
+  const staging = markdownSection(readme, "## Staging deployment");
+
+  assert.doesNotMatch(
+    readme,
+    /^Pushes and pull requests do not start GitHub Actions automatically\./m,
+  );
+  assert.match(
+    production,
+    /^Production pushes and pull requests do not start GitHub Actions automatically\./m,
+  );
+  assert.match(
+    staging,
+    /Staging Backend Quality Gate[\s\S]*only a successful push to `staging` can publish/i,
+  );
+  assert.match(staging, /automatic `Deploy staging`/i);
+});
+
 test("first staging deployment is executable and cannot route publish through main", () => {
   const readme = readFileSync(deploymentReadmeUrl, "utf8");
   const staging = markdownSection(readme, "## Staging deployment");