deploy: remove the CI pipeline; deploys are manual

No runner was ever active, so the pipeline never ran. Removes
.gitea/workflows/deploy.yml and the CI key and runner IP from
host/bootstrap.sh (a re-run removes the key an earlier bootstrap installed).
The README makes "Manual deploy" the one documented procedure: commit on main,
shellcheck in Docker (-S warning; the pipeline's lint step), git archive over
root SSH, deploy.sh as user deploy, the outside checks, then push.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

deploy/deploy.sh

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 # Server-side deploy, run as the non-root deploy user:
-#   deploy.sh <sha> <incoming-dir>   CI: finalize the upload as releases/<sha>, then deploy it
+#   deploy.sh <sha> <incoming-dir>   manual deploy: finalize the upload as releases/<sha>, then deploy it
 #   deploy.sh <sha>                  re-deploy a release that is already finalized
 #
 # Order: lock, finalize, artifacts, preflight, image build and downgrade guard
@@ -11,7 +11,7 @@ set -euo pipefail
 # shellcheck source=deploy/lib.sh
 . "$(dirname "$(readlink -f "$0")")/lib.sh"
 
-# finalize_release <sha> <upload>: CI never writes into releases/. A new SHA is
+# finalize_release <sha> <upload>: an upload never writes into releases/. A new SHA is
 # moved in atomically; a re-run of a deployed SHA must match it byte for byte
 # and leaves the finalized release, ARTIFACTS included, untouched.
 finalize_release() {
@@ -100,10 +100,10 @@ retention() {
     rm -rf "$dir"
     log "removed release ${dir##*/}"
   done < <(find "$RELEASES" -mindepth 1 -maxdepth 1 -type d -printf '%T@ %p\n' | sort -rn | tail -n +6 | cut -d' ' -f2-)
-  # Uploads older than a day were never finalized (interrupted CI runs). Their
-  # mtime is the server's (the workflow's rsync omits directory times), and a
-  # CI job lives at most 45 minutes, so an upload being sent or waiting for the
-  # lock is never this old.
+  # Uploads older than a day were never finalized (interrupted deploys). The
+  # upload directory is created on the server when the upload starts, and its
+  # mtime is the server's, so an upload being sent or waiting for the lock is
+  # never this old.
   while IFS= read -r -d '' dir; do
     chmod -R u+w "$dir"
     rm -rf "$dir"

deploy/lib.sh

@@ -57,8 +57,8 @@ die() { log "ERROR: $*"; exit 1; }
 # is absolute, so nothing needs the caller's directory.
 cd /
 
-# acquire_lock <seconds>: deploy.sh and rollback.sh share this lock, so a CI
-# deploy and a manual rollback never run at the same time. Held until exit.
+# acquire_lock <seconds>: deploy.sh and rollback.sh share this lock, so a
+# deploy and a rollback never run at the same time. Held until exit.
 acquire_lock() {
   exec 9>>"$LOCK_FILE"
   flock -w "$1" 9 || die "another deploy or rollback holds $LOCK_FILE (waited $1 s)"