ci: move the bump job's master guard from job level to step level

bump skipped at 0s on a genuine push to master (event: push, head_branch: master)
— before the image job it depends on had even started. The identical expression on
the 'push by digest' STEP inside the matrix job evaluates true and runs, so the
expression is fine; Gitea does not resolve a job-level if correctly when needs
points at a matrix job.

needs: [image] still orders it and still gates on all three legs. The steps carry
the guard in the form this runner is known to evaluate. A PR now starts the job and
no-ops every step, which is a few seconds for a guard that actually fires.

.gitea/workflows/ci.yaml

@@ -376,11 +376,23 @@ jobs:
   bump:
     runs-on: ubuntu-latest
     needs: [image]
-    if: github.ref == 'refs/heads/master' && github.event_name == 'push'
+    # The master+push guard lives on the STEPS, not on the job.
+    #
+    # A job-level `if` here evaluated false and skipped `bump` at 0s — before `image` had
+    # even started — on a genuine push to master (`event: push`, `head_branch: master`).
+    # The identical expression on the `push by digest` STEP inside the matrix job evaluates
+    # true and runs. Gitea appears not to resolve a job-level `if` correctly when `needs`
+    # points at a matrix job.
+    #
+    # `needs: [image]` still does the ordering and still gates on all three legs passing.
+    # The steps below carry the branch guard, in the form this runner is known to evaluate
+    # correctly. On a PR the job starts and every step no-ops, which costs a few seconds
+    # and is the price of a guard that actually fires.
     permissions:
       contents: write
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        if: github.ref == 'refs/heads/master' && github.event_name == 'push'
         with:
           # A bot token with contents:write on this repo and nothing else: no kubeconfig,
           # no cluster credential, no ArgoCD API token. CI's maximum blast radius is a bad
@@ -388,11 +400,13 @@ jobs:
           token: ${{ secrets.CI_BOT_TOKEN }}
           ref: master
       - uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
+        if: github.ref == 'refs/heads/master' && github.event_name == 'push'
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ secrets.REGISTRY_USER }}
           password: ${{ secrets.REGISTRY_TOKEN }}
       - name: bump image digests in the chart
+        if: github.ref == 'refs/heads/master' && github.event_name == 'push'
         env:
           REGISTRY: ${{ env.REGISTRY }}
           IMAGE_NS: ${{ env.IMAGE_NS }}