release(runway): cherry-pick fix(ci): restrict AMO flask/production to release/*; block flask dispatch

[runway-github]

• fix(ci): restrict AMO flask/production to release/*; block flask dispatch (fix(ci): restrict AMO flask/production to release/*; block flask dispatch #45302)

Description

Align AMO production and flask to release/* only (not
main) so uploads use the same workflow version as the cut.

Flask remains orchestrator-only: flask is removed from
workflow_dispatch target options, and the sender check rejects any
human/non-Runway flask dispatch. Do not gate on github.event_name
— in a reusable workflow that value is the caller's trigger, so a Runway
orchestrator workflow_call (itself workflow_dispatch) would falsely
fail. Keep workflow_call for Runway Phase 3.

Companion: infra PR
#19
(amo-submission-flask + amo-submission-production OIDC release/*
only). Docs:
releases#32.

GitHub Environment config (done):

• Remove required reviewers on amo-flask
• Set amo-flask and amo-production deployment branches to
  release/* only (remove main)

Changelog

CHANGELOG entry: null

Related issues

Fixes: INFRA-3769

Manual testing steps

1. On release/X.Y.Z, Actions → Upload extension to Firefox AMO —
   targets are production and dev only (flask not offered).
2. target=production on release/* passes the branch guard (then
   waits on amo-production approval).
3. target=production on main fails the branch guard.
4. Orchestrator workflow_call with target=flask still succeeds
   (sender = Runway; no env reviewers on amo-flask).
5. Human attempt at flask (API/workflow_call from a user) fails the
   sender check before AWS creds.

Screenshots/Recordings

N/A

Before

N/A

After

N/A

Pre-merge author checklist

• I've followed MetaMask Contributor
  Docs and MetaMask
  Extension Coding
  Standards.
• I've completed the PR template to the best of my ability
• I've included tests if applicable
• I've documented my code using JSDoc format
  if applicable
• I've applied the right labels on the PR (see labeling
  guidelines).
  Not required for external contributors.

Pre-merge reviewer checklist

• I've manually tested the PR (e.g. pull and build branch, run the
  app, test code being changed).
• I confirm that this PR addresses all acceptance criteria described
  in the ticket it closes and includes the necessary testing evidence such
  as recordings and or screenshots.

---

Co-authored-by: Cursor cursoragent@cursor.com bc18c5c

[github-actions]

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[gauthierpetetin]

No release label on PR. Adding release label release-13.43.0 on PR, as PR was cherry-picked in branch 13.43.0.