fix(cd): skip image deploy for metadata-only runtime fixes [metadata-only]

ops/runner/test_cd_controlled_runtime_profile.py

@@ -782,6 +782,19 @@ def test_controlled_runtime_skips_b5_before_docker_socket_use() -> None:
     assert controlled_gate < exit_zero < docker_socket
 
 
+def test_metadata_only_marker_skips_deploy_jobs_after_tests() -> None:
+    text = _workflow_text()
+    tests_header = text.split("tests:", 1)[1].split("steps:", 1)[0]
+    build_header = text.split("build-and-deploy:", 1)[1].split("steps:", 1)[0]
+    post_deploy_header = text.split("post-deploy-checks:", 1)[1].split("steps:", 1)[0]
+
+    metadata_gate = "contains(github.event.head_commit.message, '[metadata-only]')"
+    assert metadata_gate not in tests_header
+    assert metadata_gate in build_header
+    assert metadata_gate in post_deploy_header
+    assert "metadata-only controlled-runtime fixes already run the" in text
+
+
 def test_b5_full_profile_fails_fast_when_docker_socket_or_db_network_is_unready() -> None:
     text = _workflow_text()
     b5_block = text.split("- name: Integration Tests (B5", 1)[1]