CI: deploy binary to versioned dir on tag push

On a tag push, scp the built hsa binary to ~/hsa-app-V<tag> on the
target host (created if missing). Reuses the FORGEJO_SSH key; host and
user come from the HSA_APP_HOST / HSA_APP_USER repo vars. Branch
pushes still only build and test.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.forgejo/workflows/build.yml

@@ -16,3 +16,12 @@ jobs:
         with:
           name: hsa
           path: hsa
+      - name: Deploy
+        if: startsWith(github.ref, 'refs/tags/')
+        run: |
+          echo "${{ secrets.FORGEJO_SSH }}" > /tmp/deploy_key
+          chmod 600 /tmp/deploy_key
+          DEST=hsa-app-V${{ github.ref_name }}
+          ssh -i /tmp/deploy_key -o StrictHostKeyChecking=no ${{ vars.HSA_APP_USER }}@${{ vars.HSA_APP_HOST }} "mkdir -p $DEST"
+          scp -i /tmp/deploy_key -o StrictHostKeyChecking=no hsa ${{ vars.HSA_APP_USER }}@${{ vars.HSA_APP_HOST }}:$DEST/hsa
+          rm /tmp/deploy_key