Rename deploy runner label to cube-host

.gitea/workflows/ci.yml

@@ -31,13 +31,13 @@ jobs:
         run: find public/js -name "*.js" -print0 | xargs -0 -n1 node --check
 
   # Handled by a separate, native (non-Docker) runner registered with the
-  # single "deploy:host" label (see docs/deployment.adoc) — it runs directly
+  # single "cube-host" label (see docs/deployment.adoc) — it runs directly
   # on the server, so it has docker/git/etc. from the host, no socket/bind
   # mount tricks needed. The Docker-based runner keeps handling `check`.
   deploy:
     needs: check
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-    runs-on: deploy
+    runs-on: cube-host
     steps:
       # Not actions/checkout@v4: keeping this plain-git checkout from when
       # the job ran in a Node-less container — no reason to add a Node

docs/deployment.adoc

@@ -10,7 +10,7 @@ instance:
   `ubuntu-latest`/`ubuntu-24.04`/`ubuntu-22.04` — runs the `check` job
   in a fresh, isolated container per job, same as before.
 * A dedicated native runner, installed directly on the host (no Docker
-  around it), label `deploy:host` — runs only the `deploy` job.
+  around it), label `cube-host` — runs only the `deploy` job.
 
 They're separate because the Docker-based runner's jobs (whether in
 its usual isolated per-job containers, or tried directly inside its
@@ -50,7 +50,7 @@ label:
 ----
 runner:
   labels:
-    - "deploy:host"
+    - "cube-host"
 ----
 
 The `host` scheme means jobs run directly via the runner process's own
@@ -110,7 +110,7 @@ usernames, e.g. `randy,friend1,friend2` — not their emails, the
 == CI deploy job
 
 `.gitea/workflows/ci.yml`'s `deploy` job runs after `check` passes, only
-on a push to `main`, with `runs-on: deploy`:
+on a push to `main`, with `runs-on: cube-host`:
 
 . Checks out the repo with plain `git` (`fetch` + `checkout`,
   authenticated via a one-off `http.extraHeader`) rather than