gitlab-ci: rules:/workflow: to make RUN_KVM_JOBS work reliably

I have RUN_KVM_JOBS set on my fork, but it often fails to trigger.
https://medium.com/devops-with-valentine/fix-gitlab-ci-duplicate-pipelines-in-merge-requests-when-using-rules-9a1486994f3a

.gitlab-ci.yml

@@ -4,6 +4,13 @@ stages:
   - test
   - deploy
 
+# only create a pipeline if it is a merge request, not for plain
+# branches, unless that branch is master.
+workflow:
+  rules:
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
+    - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
+
 .base:
   before_script:
     - test -e /etc/apt/sources.list.d/bullseye-backports.list
@@ -132,9 +139,8 @@ errorprone:
   tags:
     - fdroid
     - kvm
-  only:
-    variables:
-      - $RUN_KVM_JOBS
+  rules:
+    - if: $RUN_KVM_JOBS
   <<: *test-template
   <<: *kvm-connected-template