ci(site): disable auto-deploy (runner can't reach groucho over SSH)

aaron routes to groucho via ada (ens18 down); the groucho->aaron data path drops
packets so the SSH banner never returns (TCP+ICMP ok). Left workflow_dispatch-only
until the network is fixed; deploy meanwhile via ansible tane-landing.yml.

.forgejo/workflows/site.yml

@@ -14,12 +14,15 @@
 
 name: site
 
+# BLOCKED (2026-07-16): the runner (aaron) cannot open an SSH data connection to
+# groucho. aaron's direct iface to groucho's subnet (ens18, 10.20.20.x) is down,
+# so aaron routes to groucho via ada (10.0.0.2) and the groucho->aaron data path
+# drops packets (TCP connects + ICMP ok, but the SSH banner never returns; proven:
+# aaron->ada:22 gets a banner, aaron->groucho:22 does not). Not MTU/fail2ban/DNS.
+# Until aaron<->groucho networking is fixed, deploy the site from a machine that
+# reaches groucho via ada:  `ansible-playbook -i comunes_inventory.ini tane-landing.yml`
+# (see site/DEPLOY.md). Trigger left manual-only so it stops failing on every push.
 on:
-  push:
-    branches: [main]
-    paths:
-      - 'site/**'
-      - 'docs/**'
   workflow_dispatch:
 
 concurrency: