ci: split build across rust + fedora runners, deploy on fedora-44

The `rust` runner image has cargo + musl but no node/pnpm, so the web build
(and the previous npm-install workaround) can't run there. The fedora runner
images bake in node + pnpm + rsync. Split the build:
- build-binaries on `rust`  (cargo musl + lint/test gate)
- build-web      on `fedora-44` (pnpm install + prerender, no install step)
Deploy jobs move to `fedora-44` (has rsync/ssh/pnpm/ca-trust) and depend on
the relevant build job.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01X7zF7Kf4JqDwa6M8Qgge9M

.gitea/workflows/deploy.yml

@@ -55,14 +55,16 @@ env:
     ${{ secrets.RSYNC_SSH_KEY }}
 
 jobs:
-  build:
-    name: Build api + worker + web
+  # The rust runner has cargo + musl but no node; the fedora runner has
+  # node + pnpm but no cargo — so the build is split across the two images.
+  build-binaries:
+    name: Build api + worker (static musl)
     runs-on: rust
     steps:
       - uses: actions/checkout@v4
 
-      # The `rust` runner image provides cargo/clippy/rustfmt, musl-gcc, the
-      # x86_64-unknown-linux-musl std, and node. No package installs at run time.
+      # The `rust` runner image provides cargo/clippy/rustfmt, musl-gcc, and the
+      # x86_64-unknown-linux-musl std. No package installs at run time.
       - name: Lint + test (deploy gate)
         run: |
           cargo fmt --check --all
@@ -72,15 +74,6 @@ jobs:
       - name: Build moments-api + moments-worker (static musl release)
         run: cargo build --release --target "${MUSL_TARGET}" -p moments-api -p moments-worker
 
-      - name: Build web (vite client + prerender)
-        run: |
-          # The gongfoo rust image ships node + npm but not corepack (Fedora's
-          # nodejs package omits it), and the build job runs as root — so install
-          # pnpm globally via npm. Bake pnpm into the runner image to drop this.
-          npm install -g pnpm@10
-          pnpm --dir ui install --frozen-lockfile
-          pnpm --dir ui run build
-
       - name: Stage binaries
         run: |
           mkdir --parents artifacts
@@ -91,13 +84,24 @@ jobs:
         with: { name: moments-api, path: artifacts/moments-api, retention-days: 1 }
       - uses: actions/upload-artifact@v3
         with: { name: moments-worker, path: artifacts/moments-worker, retention-days: 1 }
+
+  build-web:
+    name: Build prerendered web
+    runs-on: fedora-44
+    steps:
+      - uses: actions/checkout@v4
+      # The fedora-44 runner image bakes in node + pnpm (+ rsync) — no install.
+      - name: Build web (vite client + prerender)
+        run: |
+          pnpm --dir ui install --frozen-lockfile
+          pnpm --dir ui run build
       - uses: actions/upload-artifact@v3
         with: { name: web-dist, path: ui/dist, retention-days: 1 }
 
   deploy-api:
     name: Deploy moments-api to nikola
-    needs: build
-    runs-on: fedora-43
+    needs: build-binaries
+    runs-on: fedora-44
     steps:
       - uses: actions/checkout@v4
       - uses: actions/download-artifact@v3
@@ -209,8 +213,8 @@ jobs:
 
   deploy-worker:
     name: Deploy moments-worker to frootmig
-    needs: build
-    runs-on: fedora-43
+    needs: build-binaries
+    runs-on: fedora-44
     steps:
       - uses: actions/checkout@v4
       - uses: actions/download-artifact@v3
@@ -299,8 +303,8 @@ jobs:
 
   deploy-web:
     name: Deploy web to oolon
-    needs: build
-    runs-on: fedora-43
+    needs: build-web
+    runs-on: fedora-44
     steps:
       - uses: actions/checkout@v4
       - uses: actions/download-artifact@v3