ci: drop the deploy job - releases come from the release path now (WP-62)

The privileged runner that built and pushed images (Docker socket = root on
the server) is retired. A commit on this branch whose CI passes is now
snapshotted by the validator, built in the sandboxed CI worker, published by
digest and promoted as a PR on clockmost-infra, which the merge gate merges.
CI here only tests.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01JNYj35rhLswffGwAHYFzia

.gitea/workflows/ci.yml

@@ -16,22 +16,3 @@ jobs:
       - run: uv sync --frozen --group server
       # no unit tests yet: the app must at least import (model + DB load in lifespan)
       - run: uv run python -c "import server.app"
-
-  deploy:
-    needs: test
-    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
-    runs-on: ubuntu-latest
-    container:
-      image: catthehacker/ubuntu:act-latest
-      volumes: [/var/run/docker.sock:/var/run/docker.sock]
-    steps:
-      - uses: actions/checkout@v4
-      - name: build, push, promote (shared deploy.sh, WP-53)
-        env:
-          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
-          INFRA_DEPLOY_KEY: ${{ secrets.INFRA_DEPLOY_KEY }}
-          INFRA_REPO_URL: ${{ secrets.INFRA_REPO_URL }}
-          INFRA_KNOWN_HOSTS: ${{ secrets.INFRA_KNOWN_HOSTS }}
-          NTFY_TOKEN: ${{ secrets.NTFY_TOKEN }}
-          COMMIT_MSG: ${{ github.event.head_commit.message }}
-        run: curl -fsSL https://git.clockmost.com/Benylin/ci-workflows/raw/branch/main/deploy.sh | bash -s -- drive-rag