CI: auto-deploy on release tags, drop manual deploy workflow

Replace the workflow_dispatch deploy with an Activate step in build.yml
that runs only for X.Y.Z tags: it repoints the ~/hsa-app/hsa symlink and
restarts the user service. Pre-release tags (e.g. 0.0.0a2) are still
built, tested, and staged into releases/ but not activated. Remove
deploy.yml and update INSTALL.md accordingly.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.forgejo/workflows/build.yml

@@ -28,3 +28,17 @@ jobs:
           scp -i /tmp/deploy_key -o StrictHostKeyChecking=no hsa $TARGET:$REL/hsa
           ssh -i /tmp/deploy_key -o StrictHostKeyChecking=no $TARGET "chmod +x $REL/hsa"
           rm /tmp/deploy_key
+      - name: Activate release
+        if: startsWith(github.ref, 'refs/tags/')
+        run: |
+          TAG=${{ github.ref_name }}
+          if ! echo "$TAG" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+$'; then
+            echo "Tag $TAG is a pre-release; staged but not activated."
+            exit 0
+          fi
+          echo "${{ secrets.FORGEJO_SSH }}" > /tmp/deploy_key
+          chmod 600 /tmp/deploy_key
+          TARGET=${{ vars.HSA_APP_USER }}@${{ vars.HSA_APP_HOST }}
+          ssh -i /tmp/deploy_key -o StrictHostKeyChecking=no $TARGET \
+            "cd hsa-app && ln -sfn releases/hsa-app-V$TAG/hsa hsa && systemctl --user restart hsa_app"
+          rm /tmp/deploy_key

.forgejo/workflows/deploy.yml

@@ -1,24 +0,0 @@
-name: Deploy
-on:
-  workflow_dispatch:
-    inputs:
-      tag:
-        description: 'Release version to activate, e.g. 0.0.0a1 (must already be staged in ~/hsa-app/releases/hsa-app-V<tag>/hsa)'
-        required: true
-jobs:
-  deploy:
-    runs-on: shell
-    steps:
-      - name: Activate release
-        run: |
-          echo "${{ secrets.FORGEJO_SSH }}" > /tmp/deploy_key
-          chmod 600 /tmp/deploy_key
-          TAG=${{ github.event.inputs.tag }}
-          TARGET=${{ vars.HSA_APP_USER }}@${{ vars.HSA_APP_HOST }}
-          ssh -i /tmp/deploy_key -o StrictHostKeyChecking=no $TARGET \
-            "cd hsa-app \
-             && test -f releases/hsa-app-V$TAG/hsa \
-             && chmod +x releases/hsa-app-V$TAG/hsa \
-             && ln -sfn releases/hsa-app-V$TAG/hsa hsa \
-             && systemctl --user restart hsa_app"
-          rm /tmp/deploy_key

deploy/INSTALL.md

@@ -1,16 +1,17 @@
 # Deploying hsa-app
 
-The app runs as a **user systemd service** (no sudo). Deployment is two steps:
+The app runs as a **user systemd service** (no sudo). Deployment is driven by
+git tags:
 
-1. **Stage (automatic on tag)** — pushing a git tag builds + tests, then CI
+- **Release tags `X.Y.Z`** (e.g. `1.2.0`) — CI builds + tests, stages the binary
-   copies the binary into `~/hsa-app/releases/hsa-app-V<tag>/hsa`. Nothing goes
+  into `~/hsa-app/releases/hsa-app-V<tag>/hsa`, then **activates** it: points the
-   live yet.
-2. **Activate (manual button)** — run the **Deploy** workflow from the Forgejo
-   Actions tab ("Run workflow"), entering the tag to activate. It points the
   `~/hsa-app/hsa` symlink at that release and restarts the service.
+- **Pre-release tags** (anything else, e.g. `0.0.0a2`) — built, tested, and
+  staged into `releases/`, but **not** activated. Nothing goes live.
 
-The symlink decouples "what's on disk" from "what's running," so activation and
+The symlink decouples "what's on disk" from "what's running," so activating a
-rollback are just a symlink repoint + restart.
+staged pre-release or rolling back is just a symlink repoint + restart (see
+below).
 
 ## Layout on the host
 
@@ -73,9 +74,8 @@ journalctl --user -u hsa_app -f    # follow logs
 
 ## Deploy a tagged release
 
-Pushing a tag stages the binary automatically. To activate it, open the repo's
+Push a release tag `X.Y.Z` — CI builds, stages, and activates it automatically.
-**Actions → Deploy** workflow, click **Run workflow**, and enter the tag (e.g.
+To manually activate a staged pre-release (or any release) from the host:
-`0.0.0a1`). To activate from the host instead:
 
 ```bash
 cd ~/hsa-app