Tidy the deploy checkout into build/, symlink docker-compose.yaml up

Sources now sync into /srv/podman/maptool/build/ (wiped and fully
replaced every deploy, nothing in it needs preserving) instead of
directly into /srv/podman/maptool/ itself, where data/ and .env also
live — the old sync step had to specifically skip data/ by name to
avoid wiping it; this way there's nothing to skip.

docker-compose.yaml is symlinked (ln -sf, relative target) from
/srv/podman/maptool/ up to build/ — both for a human to still find it
at the top, and because that symlink's own location, not build/, is
what compose resolves ./data and .env's directory against. No changes
to docker-compose.yaml or the podman-compose@.service systemd unit's
WorkingDirectory needed.

Verified against a full local dry run of the new sync step (copy into
a fake build/, symlink up, confirm pre-existing data/ survives) and
`docker-compose config` against the real docker-compose.yaml through
that symlink — both volume mounts (./data, the kiwix ZIM path)
resolved to the sibling data/ directory as intended, not build/data.

.gitea/workflows/ci.yml

@@ -62,21 +62,26 @@ jobs:
       - name: Write REVISION
         run: git rev-parse --short HEAD > REVISION
 
-      # Clears out everything in the target except data/ (uploaded GPX
-      # files, offline.pmtiles) and copies the fresh checkout over, dropping
-      # .git afterwards. Dotfiles like .env (deployment secrets) are left
-      # alone too — the glob below doesn't match them — and neither is ever
-      # part of the git checkout in the first place, since both are
-      # gitignored.
-      - name: Sync to /srv/podman/maptool
+      # The checkout lives in build/, wiped and fully replaced every
+      # deploy — data/ and .env live one level up, in /srv/podman/maptool/
+      # itself, so they're never inside the directory this nukes and never
+      # need special-casing here (an earlier version of this step had to
+      # skip data/ by name for exactly that reason). docker-compose.yaml
+      # itself is symlinked up to /srv/podman/maptool/ (relative target, so
+      # it survives /srv/podman itself ever being renamed) purely for
+      # discoverability — a human poking around expects to find it at the
+      # top, not a level down — and because that's what makes `./data` in
+      # it resolve to the sibling directory: compose resolves a relative
+      # volume path against the *symlink's* location, not build/ (verified
+      # against plain `docker-compose config`), so podman-compose@.service's
+      # own WorkingDirectory=/srv/podman/maptool needs no change either.
+      - name: Sync to /srv/podman/maptool/build
         run: |
-          mkdir -p /srv/podman/maptool
-          for f in /srv/podman/maptool/*; do
-            [ "$(basename "$f")" = "data" ] && continue
-            rm -rf "$f"
-          done
-          cp -a . /srv/podman/maptool/
-          rm -rf /srv/podman/maptool/.git
+          rm -rf /srv/podman/maptool/build
+          mkdir -p /srv/podman/maptool/build
+          cp -a . /srv/podman/maptool/build/
+          rm -rf /srv/podman/maptool/build/.git
+          ln -sf build/docker-compose.yaml /srv/podman/maptool/docker-compose.yaml
 
       # Regenerated on every deploy from repo secrets (Settings -> Actions
       # -> Secrets) rather than created once by hand on the server — see