fix: CI branch filter + Cursor auto-context rules

CI:
- python-services-ci now only runs on main branch (not feature branches)
- Install deps with lock fallback (if lock file is stale, install without it)

Cursor rules:
- New project-context.mdc (alwaysApply: true) — gives AI full project
  context immediately in every new chat
- Updated noda1-operations.mdc: alwaysApply: true, fixed container names
  (dagi-router-node1, not dagi-staging-router)

This ensures that when opening a new Cursor chat in this workspace,
the AI already knows: project structure, NODE1 server details, all 13
agents, SSH credentials location, and key documentation paths.

Co-authored-by: Cursor <cursoragent@cursor.com>

.github/workflows/python-services-ci.yml

@@ -2,11 +2,13 @@ name: python-services-ci
 
 on:
   push:
+    branches: [main]
     paths:
       - "services/**"
       - "gateway-bot/**"
       - ".github/workflows/python-services-ci.yml"
   pull_request:
+    branches: [main]
     paths:
       - "services/**"
       - "gateway-bot/**"
@@ -33,11 +35,16 @@ jobs:
           python-version: "3.11"
           cache: "pip"
 
-      - name: Install deps (locked)
+      - name: Install deps
         working-directory: ${{ matrix.service }}
         run: |
           python -m pip install --upgrade pip
-          python -m pip install -r requirements.txt -c requirements.lock
+          if [ -f requirements.lock ]; then
+            python -m pip install -r requirements.txt -c requirements.lock || \
+            python -m pip install -r requirements.txt
+          else
+            python -m pip install -r requirements.txt
+          fi
 
       - name: Pip check
         working-directory: ${{ matrix.service }}