fix(ci): allow ECR publish on workflow_dispatch and relax OIDC trust policy

[e9e4e5f0faef]

Summary

• Allow the ECR publish job to run on workflow_dispatch events (previously only push)
• Remove job_workflow_ref from IAM OIDC trust policy (not supported by aws-actions/configure-aws-credentials)

Changes

File	Change
.github/workflows/build-and-push.yml	Add workflow_dispatch to publish and publish-disabled job conditions
infra/pulumi/__main__.py	Remove job_workflow_ref and redundant iss from OIDC trust policy

Why

Two CI issues discovered during stage deployment validation:

1. Publish never ran on manual dispatch: the publish job condition required github.event_name == 'push', so workflow_dispatch builds succeeded but never pushed to ECR. stage-latest was stale since Feb 27.

2. Push-triggered builds failed OIDC auth: the job_workflow_ref claim is present in GitHub OIDC tokens but aws-actions/configure-aws-credentials does not pass it to sts:AssumeRoleWithWebIdentity. Including it as an IAM trust policy condition caused all push events to fail.

Validation

• OIDC trust policy fix already applied to AWS via pulumi up (IAM role updated immediately)
• Manual dispatch confirmed working after the trust policy fix
• All three ECS services (web, worker, versioncheck) running healthy on stage using the corrected stage-latest image

Safety

No impact on running services. The trust policy change is already live in AWS; this PR syncs the code to match.