Never run deployment jobs on merge-queue refs

Changes

diff --git a/src/runner.rs b/src/runner.rs
index 6daaf08..1a689bc 100644
--- a/src/runner.rs
+++ b/src/runner.rs
@@ -563,13 +563,35 @@ impl Runner {
                     .ok()
             })
             .is_some_and(|detail| detail.pull_request.target_ref == repository_default_branch);
+        // Validating a merge is not the same as landing it. A merge-queue ref
+        // is a commit that has not merged and may never merge, so a job that
+        // deploys (`environment:` set) must not run there: it would put
+        // unmerged code in production, and an approval-gated one deadlocks the
+        // queue waiting for a human inside what is only a merge check. Both
+        // happened: deploy-production ran from refs/merge-queue/3 and restarted
+        // this very service mid-run, killing a concurrent run; AkurAI-Framework
+        // then stalled forever on its approval-gated deploy. The post-merge
+        // default-branch run owns deployment.
+        if queue_targets_default && spec.environment.is_some() {
+            self.database.set_job_status(
+                job_id,
+                "skipped",
+                Some(
+                    "deployment jobs do not run on merge-queue refs; the \
+                     post-merge default-branch run deploys",
+                ),
+                None,
+            )?;
+            return Ok(());
+        }
         // `branches:` filters are matched against the branch this ref is going
         // to BECOME, not its literal name. A merge-queue staging ref is the
         // default branch's own pre-merge commit, so a job gated on `[main]`
         // must run there -- otherwise the queue's CI is strictly WEAKER than
-        // the branch's, which inverts the gate: verify/package/deploy-production
-        // all skipped on refs/merge-queue/N and the merge landed code that was
-        // never packaged, never deployed, and never saw fmt/clippy/full tests.
+        // the branch's, which inverts the gate: verify and package were skipped
+        // on refs/merge-queue/N and the merge landed code that was never
+        // packaged and never saw fmt/clippy/full tests. Deployment jobs are the
+        // deliberate exception, skipped just above.
         // This mirrors the native-executor trust exception directly above.
         let effective_branch = if queue_targets_default {
             repository_default_branch.as_str()
@@ -2047,10 +2069,11 @@ mod tests {
     #[test]
     fn branch_filter_matches_merge_queue_refs_targeting_the_default_branch() -> Result<()> {
         // A `branches: [main]` job MUST run on refs/merge-queue/N when that
-        // entry's PR targets main. Before this, verify/package/deploy-production
-        // all skipped on the queue ref, so the queue's CI was strictly weaker
-        // than the branch's and a queue merge landed code that was never
-        // packaged, never deployed, and never saw fmt/clippy/full tests.
+        // entry's PR targets main. Before this, verify and package skipped on
+        // the queue ref, so the queue's CI was strictly weaker than the
+        // branch's and a queue merge landed code that was never packaged and
+        // never saw fmt/clippy/full tests. Deployment jobs are the deliberate
+        // exception -- see deployment_jobs_do_not_run_on_merge_queue_refs.
         let root = tempfile::tempdir()?;
         let database = Database::memory(KEY)?;
         let repo = database.add_repository("app", "https://example.com/app.git", "main")?;
@@ -2086,6 +2109,67 @@ mod tests {
         Ok(())
     }
 
+    #[test]
+    fn deployment_jobs_do_not_run_on_merge_queue_refs() -> Result<()> {
+        // A merge-queue ref validates a merge that has not landed and may never
+        // land, so a job with `environment:` set must be skipped there even
+        // though its `branches: [main]` filter now matches. Letting it run put
+        // unmerged code into production (deploy-production executed from
+        // refs/merge-queue/3 and restarted this service mid-run), and an
+        // approval-gated deployment stalled the queue forever waiting on a
+        // human inside what is only a merge check.
+        let root = tempfile::tempdir()?;
+        let database = Database::memory(KEY)?;
+        let repo = database.add_repository("app", "https://example.com/app.git", "main")?;
+        database.create_pull_request(
+            "app",
+            "Feature",
+            "",
+            "feature",
+            "main",
+            &"a".repeat(40),
+            &"b".repeat(40),
+            "alice",
+            "Alice",
+        )?;
+        database.add_pull_request_review("app", 1, "bob", "Bob", "approved", "ship it")?;
+        let entry = database.enqueue_merge("app", 1, "tester")?;
+        let run_id = database.create_run(
+            repo.id,
+            &format!("refs/merge-queue/{}", entry.id),
+            None,
+            "webhook",
+        )?;
+        let mut deploy = make_job_spec("deploy-production", "native", None);
+        deploy.branches = vec!["main".into()];
+        deploy.environment = Some("production".into());
+        let mut build = make_job_spec("build", "native", None);
+        build.branches = vec!["main".into()];
+        database.insert_jobs(run_id, &[deploy, build])?;
+        let runner = Runner::new(database, root.path().to_owned(), true)?;
+        let workspace = root.path().join("workspaces").join(run_id.to_string());
+        fs::create_dir_all(&workspace)?;
+        for job in runner.database.jobs(run_id)? {
+            runner.execute_job(run_id, job.id, &workspace, &RunCancellation::new())?;
+        }
+        let jobs = runner.database.jobs(run_id)?;
+        let deploy = jobs
+            .iter()
+            .find(|job| job.name == "deploy-production")
+            .expect("deploy job");
+        assert_eq!(deploy.status, "skipped", "{:?}", deploy.logs);
+        assert!(
+            deploy.logs.contains("merge-queue"),
+            "skip reason must say why a deployment job did not run: {:?}",
+            deploy.logs
+        );
+        // The non-deployment job on the same ref must still run, otherwise this
+        // would re-break the gate the branch-filter fix exists to close.
+        let build = jobs.iter().find(|job| job.name == "build").expect("build");
+        assert_eq!(build.status, "succeeded", "{:?}", build.logs);
+        Ok(())
+    }
+
     #[test]
     fn branch_filter_still_skips_an_unrelated_ref_and_says_why() -> Result<()> {
         let root = tempfile::tempdir()?;