diff --git a/.gitea/workflows/quality.yml b/.gitea/workflows/quality.yml
index 4280a96..606d211 100644
--- a/.gitea/workflows/quality.yml
+++ b/.gitea/workflows/quality.yml
@@ -1,46 +1,46 @@
-name: ForgeFlow quality gate
-
+name: ForgeFlow quality gate
+
 on:
   push:
     branches: [main]
-  pull_request:
-
-jobs:
-  secret-scan:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Secret scan
-        shell: bash
-        run: |
-          set -euo pipefail
-          scan_container="$(docker create ghcr.io/trufflesecurity/trufflehog:3.79.0 filesystem /scan --only-verified --fail --no-update)"
-          trap 'docker rm -f "${scan_container}" >/dev/null 2>&1 || true' EXIT
-          tar --exclude=.git --transform='s#^\.$#scan#;s#^\./#scan/#' -cf - . | docker cp - "${scan_container}:/"
-          docker start -a "${scan_container}"
-
-  quality:
-    # Browser quality runs against the dedicated bounded Windows 11 VM runner.
-    runs-on: windows-native
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: npm
-      - run: npm ci
-      # The native runner deliberately skips Electron's install-time binary
-      # download. Prime it once before Node's parallel test workers require
-      # Electron, otherwise they can race while creating the same directory.
-      - run: npx electron --version
-      - run: npm run quality
-      - run: npx playwright install chromium
-      - run: npm run test:browser:ci
-      - name: Preserve browser failure evidence
-        if: failure()
-        uses: actions/upload-artifact@v3.2.2-node20
-        with:
-          name: forgeflow-browser-failure-evidence
-          path: artifacts/
-          if-no-files-found: ignore
-      - run: npm audit --omit=dev --audit-level=high
+  workflow_dispatch:
+
+jobs:
+  secret-scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Secret scan
+        shell: bash
+        run: |
+          set -euo pipefail
+          scan_container="$(docker create ghcr.io/trufflesecurity/trufflehog:3.79.0 filesystem /scan --only-verified --fail --no-update)"
+          trap 'docker rm -f "${scan_container}" >/dev/null 2>&1 || true' EXIT
+          tar --exclude=.git --transform='s#^\.$#scan#;s#^\./#scan/#' -cf - . | docker cp - "${scan_container}:/"
+          docker start -a "${scan_container}"
+
+  quality:
+    # Browser quality runs against the dedicated bounded Windows 11 VM runner.
+    runs-on: windows-native
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+      - run: npm ci
+      # The native runner deliberately skips Electron's install-time binary
+      # download. Prime it once before Node's parallel test workers require
+      # Electron, otherwise they can race while creating the same directory.
+      - run: npx electron --version
+      - run: npm run quality
+      - run: npx playwright install chromium
+      - run: npm run test:browser:ci
+      - name: Preserve browser failure evidence
+        if: failure()
+        uses: actions/upload-artifact@v3.2.2-node20
+        with:
+          name: forgeflow-browser-failure-evidence
+          path: artifacts/
+          if-no-files-found: ignore
+      - run: npm audit --omit=dev --audit-level=high