Automate deployment: push to main now deploys itself

Registered a repo-scoped self-hosted runner (hcl-local-deploy) directly on
the box serving hcl.archipelago-foundation.org, running in host (not
docker) execution mode. Deploy is a plain local rsync — no SSH keys or
remote credentials needed, since the runner already has filesystem access
to the docroot. Runs as the debian user with no sudo; docroot ownership
was changed from www-data to debian so this works without any privilege
escalation (nginx only needs read access to serve it).

ci.yml now runs on pull_request only — deploy.yml already validates before
deploying on push to main, so running both on every push would just
duplicate the check.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -1,8 +1,8 @@
 name: Build and validate
 
+# PR-only: push to main is covered by deploy.yml, which validates and then
+# deploys in one job — running both here too would just duplicate the check.
 on:
-  push:
-    branches: [main]
   pull_request:
 
 jobs: