ci: split build across rust + fedora runners, deploy on fedora-44

The `rust` runner image has cargo + musl but no node/pnpm, so the web build
(and the previous npm-install workaround) can't run there. The fedora runner
images bake in node + pnpm + rsync. Split the build:
- build-binaries on `rust`  (cargo musl + lint/test gate)
- build-web      on `fedora-44` (pnpm install + prerender, no install step)
Deploy jobs move to `fedora-44` (has rsync/ssh/pnpm/ca-trust) and depend on
the relevant build job.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01X7zF7Kf4JqDwa6M8Qgge9M

.gitea/workflows/refresh.yml

@@ -33,13 +33,11 @@ env:
 jobs:
   build-web:
     name: Rebuild prerendered web
-    runs-on: rust            # image has node; we only need the web toolchain here
+    runs-on: fedora-44       # image bakes in node + pnpm; that's all we need here
     steps:
       - uses: actions/checkout@v4
       - name: Build web (vite client + prerender)
         run: |
-          # gongfoo rust image has node + npm but not corepack; job runs as root.
-          npm install -g pnpm@10
           pnpm --dir ui install --frozen-lockfile
           pnpm --dir ui run build
       - uses: actions/upload-artifact@v3
@@ -48,7 +46,7 @@ jobs:
   deploy-web:
     name: Deploy refreshed web to oolon
     needs: build-web
-    runs-on: fedora-43
+    runs-on: fedora-44
     steps:
       - uses: actions/checkout@v4
       - uses: actions/download-artifact@v3