ci: workflow_dispatch for build + deploy releases

Forgejo Actions workflow that runs ./build alpha|beta|release [version]
followed by ./deploy --releases. Uses the host-mode runner so the
behavior is identical to manual cuts. Tag-trigger added later once
the dispatch path is exercised.

.forgejo/workflows/deploy-release.yml

@@ -0,0 +1,60 @@
+name: Build + deploy releases
+
+# Cuts a channel/release bundle (./build alpha|beta|release [version])
+# and rsyncs it to /srv/zddc/releases/ via ./deploy --releases. Runs on
+# this host directly (label: host) — same shell environment the operator
+# uses for manual cuts, so behavior is identical between the two paths.
+#
+# Triggers (current):
+#   - workflow_dispatch — pick channel + optional version from the UI.
+# Triggers (planned, once dispatch path is proven):
+#   - tag push matching zddc-server-v[0-9]+.[0-9]+.[0-9]+ (the canonical
+#     stable cut tag in our six-tag lockstep set) → re-cuts from the
+#     tagged source for reproducibility.
+
+on:
+  workflow_dispatch:
+    inputs:
+      channel:
+        description: 'Channel to cut'
+        required: true
+        type: choice
+        default: alpha
+        options:
+          - alpha
+          - beta
+          - release
+      version:
+        description: 'Stable version (e.g. 0.1.0). Leave blank for coordinated next-stable. Ignored for alpha/beta.'
+        required: false
+        default: ''
+
+jobs:
+  build-and-deploy:
+    runs-on: host
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          # ./build's _coordinated_next_stable reads tags across all six
+          # tools; full history + tags are required.
+          fetch-depth: 0
+
+      - name: Build
+        run: |
+          set -eu
+          if [ "${{ inputs.channel }}" = "release" ] && [ -n "${{ inputs.version }}" ]; then
+              ./build release "${{ inputs.version }}"
+          else
+              ./build "${{ inputs.channel }}"
+          fi
+
+      - name: Deploy releases
+        run: ./deploy --releases
+
+      - name: Verify channel mirror resolves
+        run: |
+          set -eu
+          curl -ksI --resolve zddc.varasys.io:8443:127.0.0.1 \
+              "https://zddc.varasys.io:8443/releases/archive_${{ inputs.channel == 'release' && 'stable' || inputs.channel }}.html" \
+              | head -3