ci: make CI fork-friendly when DEPLOY_KEY secret is absent

[quangdang46]

What

The fork's CI has never run (gh api repos/quangdang46/jcode/actions/runs returns total_count=0 for both pull_request and push events) because upstream's workflows assume a DEPLOY_KEY SSH secret that the fork does not have. This is why none of PRs #174-#195 show CI status.

Changes

1. Gate every webfactory/ssh-agent@v0.9.0 step on if: ${{ secrets.DEPLOY_KEY != '' }} so the SSH agent setup is simply skipped when the secret is absent. Safe here because no Cargo git dependency in this fork uses SSH URLs:

   • agentgrep → https://github.com/1jehuang/agentgrep.git
   • mermaid-rs-renderer → https://github.com/1jehuang/mermaid-rs-renderer.git

   The actions/checkout@v4 step's empty ssh-key falls back to the GITHUB_TOKEN HTTPS path automatically.

   Applies to 5 jobs in .github/workflows/ci.yml + 1 step in .github/workflows/release.yml.

2. Add workflow_dispatch: to ci.yml so maintainers can trigger CI manually from the Actions tab while debugging without having to force-push a no-op commit.

One-time fork owner step (cannot be done via PR)

GitHub disables Actions on a freshly-forked repo until you visit the Actions tab once and click "I understand my workflows, go ahead and enable them":

• https://github.com/quangdang46/jcode/actions

After this PR is merged AND the fork's Actions are enabled, future PRs will automatically run CI. To verify after enable, you can manually trigger the new workflow_dispatch:

gh workflow run ci.yml --repo quangdang46/jcode --ref master

Tests

$ python3 -c "import yaml; yaml.safe_load(open('.github/workflows/ci.yml'))"
OK
$ python3 -c "import yaml; yaml.safe_load(open('.github/workflows/release.yml'))"
OK

Both YAML files parse cleanly. The 5 if: insertions are syntactically minimal — they only add a single line per ssh-agent step.

Notes

If you want CI to also exercise the SSH-deploy-key path (e.g. to validate it for an eventual private-dep setup), add a DEPLOY_KEY repo secret via:

gh secret set DEPLOY_KEY --repo quangdang46/jcode < ~/.ssh/your_deploy_key

Without the secret, the gated steps are simply skipped — they do NOT fail the workflow.