Route Gitea image contract to trusted runner

.github/workflows/candidate.yml

@@ -267,9 +267,12 @@ jobs:
           retention-days: 30
 
   exact-image-contract-gitea:
-    if: github.server_url != 'https://github.com'
+    if: >-
+      github.server_url != 'https://github.com' &&
+      (github.event_name == 'workflow_dispatch' ||
+      (github.event_name == 'push' && github.ref == 'refs/heads/main'))
     needs: prepare
-    runs-on: ubuntu-latest
+    runs-on: heyoka-image-build
     name: Gitea full exact image matrix
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0