Move deploy job to a dedicated native runner

The Docker-based runner's own container is too minimal for host-mode
jobs (no rsync, docker CLI, or Node.js) and has no reliable path to
the host filesystem or systemctl otherwise. Register a separate,
native runner (label deploy:host) just for deployment, and point the
deploy job at it.

.gitea/workflows/ci.yml

@@ -30,18 +30,18 @@ jobs:
       - name: JS syntax check
         run: find public/js -name "*.js" -print0 | xargs -0 -n1 node --check
 
-  # Runs directly in the runner's own container (see the "host" label in the
-  # runner's config.yaml), not in an ephemeral per-job container — that's
-  # what gives this job access to /var/run/docker.sock (already mounted into
-  # the runner container) and to /srv/docker (bind-mounted there too, see
-  # docs/deployment.adoc). No systemd/sudo involved.
+  # Handled by a separate, native (non-Docker) runner registered with the
+  # single "deploy:host" label (see docs/deployment.adoc) — it runs directly
+  # on the server, so it has docker/git/etc. from the host, no socket/bind
+  # mount tricks needed. The Docker-based runner keeps handling `check`.
   deploy:
     needs: check
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-    runs-on: host
+    runs-on: deploy
     steps:
-      # Not actions/checkout@v4: it's a JS action and host-mode jobs run
-      # directly in the runner container, which has git but no Node.js.
+      # Not actions/checkout@v4: keeping this plain-git checkout from when
+      # the job ran in a Node-less container — no reason to add a Node
+      # dependency back in for something this already does.
       - name: Checkout
         run: |
           rm -rf .git * .[!.]* 2>/dev/null
@@ -51,15 +51,10 @@ jobs:
             fetch --depth 1 origin "${{ gitea.sha }}"
           git checkout -q FETCH_HEAD
 
-      # /srv/docker/maptool is the same path inside the runner container and
-      # on the real host (1:1 bind mount) — required so the relative bind
-      # mount `./data:/app/data` in docker-compose.yaml resolves to the
-      # correct real host path when the daemon creates the container.
-      #
-      # No rsync in the runner image, so this clears out everything in the
-      # target except data/ (uploaded GPX files, offline.pmtiles — never
-      # part of the git checkout in the first place, since it's gitignored)
-      # and copies the fresh checkout over, dropping .git afterwards.
+      # Clears out everything in the target except data/ (uploaded GPX
+      # files, offline.pmtiles — never part of the git checkout in the
+      # first place, since it's gitignored) and copies the fresh checkout
+      # over, dropping .git afterwards.
       - name: Sync to /srv/docker/maptool
         run: |
           mkdir -p /srv/docker/maptool