ci: remove internal CA dependency for DMZ-compatible public branch

Strip ipa.kindred.internal CA trust steps. The public Gitea instance
uses a publicly-trusted certificate. Trigger CI on both main and
public branches.

.gitea/workflows/ci.yaml

@@ -2,9 +2,9 @@ name: CI
 
 on:
   push:
-    branches: [main]
+    branches: [main, public]
   pull_request:
-    branches: [main]
+    branches: [main, public]
   workflow_dispatch:
     inputs:
       run_datagen:
@@ -37,12 +37,6 @@ jobs:
     env:
       PATH: /tmp/solver-venv/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
     steps:
-      - name: Trust internal CA
-        run: |
-          curl -sk https://ipa.kindred.internal/ipa/config/ca.crt \
-            -o /usr/local/share/ca-certificates/kindred-internal.crt
-          update-ca-certificates
-
       - name: Checkout
         uses: https://github.com/actions/checkout@v4
 
@@ -66,12 +60,6 @@ jobs:
     env:
       PATH: /tmp/solver-venv/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
     steps:
-      - name: Trust internal CA
-        run: |
-          curl -sk https://ipa.kindred.internal/ipa/config/ca.crt \
-            -o /usr/local/share/ca-certificates/kindred-internal.crt
-          update-ca-certificates
-
       - name: Checkout
         uses: https://github.com/actions/checkout@v4
 
@@ -97,12 +85,6 @@ jobs:
     env:
       PATH: /tmp/solver-venv/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
     steps:
-      - name: Trust internal CA
-        run: |
-          curl -sk https://ipa.kindred.internal/ipa/config/ca.crt \
-            -o /usr/local/share/ca-certificates/kindred-internal.crt
-          update-ca-certificates
-
       - name: Checkout
         uses: https://github.com/actions/checkout@v4
 
@@ -120,23 +102,17 @@ jobs:
         run: pytest tests/ freecad/tests/ -v --tb=short
 
   # ---------------------------------------------------------------------------
-  # Dataset generation — manual trigger or on main push
+  # Dataset generation — manual trigger or on main/public push
   # ---------------------------------------------------------------------------
   datagen:
     runs-on: ubuntu-latest
     if: >-
       (github.event_name == 'workflow_dispatch' && inputs.run_datagen == true) ||
-      (github.event_name == 'push' && github.ref == 'refs/heads/main')
+      (github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/public'))
     needs: [test]
     env:
       PATH: /tmp/solver-venv/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
     steps:
-      - name: Trust internal CA
-        run: |
-          curl -sk https://ipa.kindred.internal/ipa/config/ca.crt \
-            -o /usr/local/share/ca-certificates/kindred-internal.crt
-          update-ca-certificates
-
       - name: Checkout
         uses: https://github.com/actions/checkout@v4