fix(ci): trigger orca on per-job result, not needs.*.result spread

Gitea act_runner evaluates contains(needs.*.result, 'success') to false
when most upstream build jobs are skipped, so single-service changes
never fired the orca redeploy.

Gate trigger-orca on explicit needs.build-<service>.result == 'success'
OR across all 8 build jobs. One green build now suffices to deploy.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.gitea/workflows/build-push-deploy.yml

@@ -313,10 +313,13 @@ jobs:
           git push --force "$PUSH_URL" "refs/tags/last-build/main"
           echo "Tag last-build/main now at ${SHA}"
 
-  # ── orca redeploy — runs only if at least one build succeeded ─────────────
-  # `always()` lets this run when some builds are skipped (unchanged services).
-  # The contains() checks ensure we only redeploy when something actually built
-  # and no build failed.
+  # ── orca redeploy — runs if at least one build was triggered AND green ────
+  # Per-job `result == 'success'` is true only when the job actually ran and
+  # passed; skipped/failed/cancelled jobs return their own status string and
+  # fail the OR. This avoids Gitea's quirky evaluation of `contains(needs.*
+  # .result, 'success')` when most upstreams are skipped (root cause of
+  # trigger-orca being skipped on single-service changes).
+  # `always()` is required so the job is evaluated when upstreams skip.
 
   trigger-orca:
     runs-on: docker
@@ -332,9 +335,16 @@ jobs:
       - build-dsms-node
     if: |
       always() &&
-      contains(needs.*.result, 'success') &&
-      !contains(needs.*.result, 'failure') &&
-      !contains(needs.*.result, 'cancelled')
+      (
+        needs.build-admin-compliance.result == 'success' ||
+        needs.build-backend-compliance.result == 'success' ||
+        needs.build-ai-sdk.result == 'success' ||
+        needs.build-developer-portal.result == 'success' ||
+        needs.build-tts.result == 'success' ||
+        needs.build-document-crawler.result == 'success' ||
+        needs.build-dsms-gateway.result == 'success' ||
+        needs.build-dsms-node.result == 'success'
+      )
     steps:
       - name: Checkout (for SHA)
         run: |