- Drop the invented per-instance token: a shared NB_PROXY_TOKEN with the
same NB_PROXY_DOMAIN is a valid HA cluster, so proxy-1 just reuses the
existing vault_netbird_proxy_token. No token to generate, no new vault
secret — removes that deploy gate entirely.
- Scope the deploy-netbird-proxy pipeline to master + manual so it stops
auto-running (and failing) on feature-branch pushes.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>