Problem

In the promote-workflow generator, writeRollbackJobs looped over every deploy and unconditionally emitted uses: <normalized workflow path>. For an inline-run deploy (declared with run: + shell: instead of workflow:), the workflow path is empty, so the generator wrote an empty uses: value followed by a with:/secrets: block. That is invalid GitHub Actions YAML and actionlint flags it: string should not be empty [syntax-check].

A rollback job is, by contract, a reusable-workflow call that reverts a deploy. An inline-run deploy has no reusable workflow to call, so it cannot have a rollback job.

Fix

Skip emitting a rollback job for any deploy whose workflow is empty (Run != ""), mirroring how the deploy jobs themselves already branch on inline-run vs reusable-workflow. Applied to both local and external deploy rollback loops. The deploy-job needs: lists reference deploy-<name> jobs (still present), not rollback-<name>, so no other job ends up depending on a now-absent rollback job.

Verification

• New table-driven unit test in internal/generate/promote_test.go: a 3-env config with an inline-run deploy generates a promote workflow with no empty uses: line, no rollback-<name>: job, the deploy-<name>: job still present, and structurally valid YAML. A mixed case keeps the rollback job for the reusable-workflow deploy.
• New e2e scenario e2e/scenarios/13-inline-run-deploy-no-rollback.yaml asserting the generated promote.yaml shape.
• go build ./... && go test ./... && golangci-lint run ./... all pass (1177 tests). e2e module builds and vets clean.
• Regenerated the example 3-env manifest and ran actionlint: the string should not be empty error at the previously-empty uses: line is gone.