ci: run environment only when manually triggered

ci/environment.yml

@@ -1,6 +1,7 @@
 environment:
   stage: environment
   image: docker
+  when: manual
   variables:
     GIT_SUBMODULE_STRATEGY: none  # no need to fetch submodules
     CONTAINER_NAME: "$CI_REGISTRY/satoshilabs/trezor/trezor-firmware/environment"
@@ -8,9 +9,6 @@ environment:
     - docker:dind
   before_script:
     - docker login $CI_REGISTRY -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD
-  only:
-    changes:
-      - ci/*
   script:
     - docker pull $CONTAINER_NAME:latest || true
     - docker build --cache-from $CONTAINER_NAME:latest --tag $CONTAINER_NAME:$CI_COMMIT_SHA --tag $CONTAINER_NAME:latest ci/