[codex] Align frontend workflow with PRE branch model

[dmarmon-gesplan]

Summary

• Limits PRE image publishing to manual workflow_dispatch runs from the pre branch.
• Keeps pull_request validation for pre/main without ECR push or deploy.
• Adds explicit PRO blocking and sends source_branch=pre in repository_dispatch payload.
• Documents the future feature/* -> pre -> main branch model.

Safety

• No Helm, kubectl, Terraform, PAT, or latest tag usage added.
• GitHub App token remains opaque and is only used for repository_dispatch.

Validation

• git diff --check