Automate deployment: push to main now deploys itself

Registered a repo-scoped self-hosted runner (hcl-local-deploy) directly on
the box serving hcl.archipelago-foundation.org, running in host (not
docker) execution mode. Deploy is a plain local rsync — no SSH keys or
remote credentials needed, since the runner already has filesystem access
to the docroot. Runs as the debian user with no sudo; docroot ownership
was changed from www-data to debian so this works without any privilege
escalation (nginx only needs read access to serve it).

ci.yml now runs on pull_request only — deploy.yml already validates before
deploying on push to main, so running both on every push would just
duplicate the check.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -1,8 +1,8 @@
 name: Build and validate
 
+# PR-only: push to main is covered by deploy.yml, which validates and then
+# deploys in one job — running both here too would just duplicate the check.
 on:
-  push:
-    branches: [main]
   pull_request:
 
 jobs:

.gitea/workflows/deploy.yml

@@ -0,0 +1,23 @@
+name: Deploy
+
+on:
+  push:
+    branches: [main]
+
+jobs:
+  deploy:
+    # Runs on a repo-scoped self-hosted runner living on the same box that
+    # serves hcl.archipelago-foundation.org, specifically so deploy is a
+    # plain local file copy — no SSH keys or remote credentials to manage.
+    runs-on: hcl-deploy
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+
+      - name: Build and validate every report
+        run: python3 scripts/build.py
+
+      - name: Deploy to the live docroot
+        run: rsync -a --delete site/ /var/www/hcl.archipelago-foundation.org/