ci(deploy): use correct runner labels and build native binaries

The first run failed with `cargo: command not found` — `runs-on: fedora-43`
is the generic (node) runner, not the Rust toolchain. Split the build:
Rust on `runs-on: rust`, the SPA on `fedora-43` (matching the fleet's
existing conventions, cf. cichlid/helexa workflows).

Also drop the musl static-cross build: the entire fleet is Fedora 43, so
native binaries built on the `rust` runner run on the targets without glibc
skew (deployment-gitea-actions.md §6 permits building on a runner no newer
than the oldest target). Removes the unverifiable musl-toolchain dependency.

Pin pnpm via packageManager so corepack resolves it deterministically.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016fKZzDpvjiJ9eYbPGgJvUP

.gitea/workflows/deploy.yml

@@ -1,12 +1,18 @@
 # CI-driven deploy for newsfeed (architecture deployment-gitea-actions.md).
 #
 # The workflow is the source of infra truth — hosts/ports/paths live here, not in a
-# manifest. Build-and-rsync model: build static musl binaries + the SPA bundle, then
-# rsync straight to the targets as the scoped `gitea_ci` user.
+# manifest. Build-and-rsync model: build the binaries + the SPA bundle, then rsync
+# straight to the targets as the scoped `gitea_ci` user.
 #
 #   api + worker  -> slartibartfast.kosherinata.internal  (share one SQLite file)
 #   web (SPA)     -> oolon.kosherinata.internal           (nginx serves + proxies /v1)
 #
+# Runners (labels match the fleet's registered runners): Rust jobs run on `rust`
+# (cargo toolchain); node/deploy jobs run on `fedora-43` (node + rsync/ssh/curl).
+# The whole fleet is Fedora 43, so binaries are built native — no glibc skew, no musl
+# toolchain needed (deployment-gitea-actions.md §6: build on a runner no newer than the
+# oldest target).
+#
 # One-time host prep (gitea_ci user, sudoers, service account, dirs, cert, vhost) is done
 # by script/infra-setup.sh. Only secret required here: RSYNC_SSH_KEY (the runner's private
 # key). newsfeed has no app secrets — SQLite has no password and tokens are hashed at rest.
@@ -25,53 +31,44 @@ env:
   API_HOST: slartibartfast.kosherinata.internal
   WEB_HOST: oolon.kosherinata.internal
   API_PORT: "8081"
-  TARGET: x86_64-unknown-linux-musl
   SSH_OPTS: -o StrictHostKeyChecking=accept-new
 
 jobs:
-  build:
-    # Toolchain runner: rustup with the musl target + musl-gcc, node+pnpm baked into the
-    # image (deployment-gitea-actions.md §5). Adjust the label to a registered runner.
+  build-api:
+    runs-on: rust
+    steps:
+      - uses: actions/checkout@v4
+      # lint/test gate: a broken commit never deploys
+      - run: cargo fmt --all --check
+      - run: cargo clippy --workspace --all-targets -- -D warnings
+      - run: cargo test --workspace
+      - name: build binaries
+        run: |
+          cargo build --release -p newsfeed-api -p newsfeed-worker
+          mkdir -p out
+          cp target/release/newsfeed-api target/release/newsfeed-worker out/
+      - uses: actions/upload-artifact@v3
+        with:
+          name: binaries
+          path: out/
+
+  build-web:
     runs-on: fedora-43
     steps:
       - uses: actions/checkout@v4
-
-      # --- lint/test gate: a broken commit never deploys ---
-      - name: fmt
-        run: cargo fmt --all --check
-      - name: clippy
-        run: cargo clippy --workspace --all-targets -- -D warnings
-      - name: test
-        run: cargo test --workspace
-
-      # --- build static binaries ---
-      - name: build binaries
-        run: |
-          rustup target add "$TARGET"
-          cargo build --release --target "$TARGET" -p newsfeed-api -p newsfeed-worker
-          mkdir -p dist/bin
-          cp "target/$TARGET/release/newsfeed-api" dist/bin/
-          cp "target/$TARGET/release/newsfeed-worker" dist/bin/
-
-      # --- build SPA bundle ---
-      - name: build web
+      - name: build SPA
         working-directory: web
         run: |
           corepack enable
           pnpm install --frozen-lockfile
           pnpm build
-
-      - uses: actions/upload-artifact@v3
-        with:
-          name: binaries
-          path: dist/bin/
       - uses: actions/upload-artifact@v3
         with:
           name: web
           path: web/dist/
 
   deploy-api:
-    needs: build
+    needs: build-api
     runs-on: fedora-43
     steps:
       - uses: actions/checkout@v4
@@ -129,7 +126,7 @@ jobs:
             'journalctl -u newsfeed-api.service -u newsfeed-worker.service -n 80 --no-pager' || true
 
   deploy-web:
-    needs: build
+    needs: build-web
     runs-on: fedora-43
     steps:
       - uses: actions/download-artifact@v3