fix(ci): mirror every successful production release

.forgejo/workflows/pipeline.yml

@@ -201,7 +201,7 @@ jobs:
         run: rm -rf .ci
 
   mirror:
-    if: github.event_name == 'push' && github.ref == 'refs/heads/main' && vars.MIRROR_ENABLED == 'true'
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     needs: deploy
     runs-on: docker
     steps:

docs/ci-cd.md

@@ -24,9 +24,9 @@ Forgejo UI:
 - `MIRROR_SSH_KEY`: private half of a write-enabled deploy key for
   `git@github.com:Fi3w0/Nereus.git`.
 
-After registering that deploy key, set the Forgejo Actions repository variable
-`MIRROR_ENABLED` to `true`. The mirror job stays skipped until both sides
-are configured, so an absent GitHub credential cannot break production deploys.
+After registering that deploy key, every successful production deployment
+pushes `main` to GitHub automatically. An absent or invalid mirror credential
+fails only the final mirror job, after production has already deployed.
 
 Before the first sealed deployment, a cluster administrator must bootstrap the
 deployer's namespaced SealedSecret permission: