ci(deploy): don't let the journal step bury the real failure

The journal capture runs `if: always()` so a failed service start still
leaves a usable record. When the job failed *before* authenticating --
the missing-secrets preflight, for instance -- it ran anyway, failed
with "Host key verification failed", and that became the last error in
the log. The actual cause was twenty lines up and easy to miss.

Conditions it on the authenticate step having succeeded, so it still
captures every case it was added for and stays quiet for the ones it
cannot help with.

Observed on run 6: the preflight correctly reported all three missing
secrets, then the journal step overwrote that with an SSH error.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XZG2i4AmfSqE97EJGBVb64

.gitea/workflows/deploy.yml

@@ -80,6 +80,7 @@ jobs:
           echo "all required secrets are present"
 
       - name: authenticate to the target
+        id: auth
         run: |
           install -d -m 0700 ~/.ssh
           printf '%s\n' "${{ secrets.RSYNC_SSH_KEY }}" > ~/.ssh/id_gitea_ci
@@ -200,6 +201,11 @@ jobs:
           ssh "$SERVICE_HOST" \
             'sudo -u rustingface /usr/local/bin/rustingface --config /etc/rustingface/config.toml doctor'
 
+      # Capture the unit's startup journal even when a later step failed --
+      # that is the record worth having. Conditioned on the target actually
+      # being reachable: without it, a job that failed before authenticating
+      # ends with "Host key verification failed", which buries the real cause
+      # under an error about something else entirely.
       - name: journal
-        if: always()
+        if: always() && steps.auth.outcome == 'success'
         run: ssh "$SERVICE_HOST" 'journalctl -u rustingface.service -n 200 --no-pager'