Reconcile Forgejo workflows with the real infrastructure now in place (#238)

The Swarm/Forgejo standup (a parallel infra track, see INFRA.md) landed real
.forgejo/workflows/{build,pr-build,deploy,deploy-dev}.yml before this PR
merged, making ci.yml a redundant duplicate of their build.yml (same build
gate, same job). Drop it.

Fix the remaining two files to match the real, already-deployed conventions
those files established rather than the guesses this PR shipped with:
runs-on: [self-hosted, thermograph] -> docker (the actual Docker-in-Docker
Swarm-hosted runner label), and appleboy/ssh-action referenced by full GitHub
URL (confirmed not mirrored on this Forgejo instance's default action
registry, per deploy.yml's own header comment) rather than the short form.
actions/checkout needed no change - already confirmed to resolve unchanged
from Forgejo's default mirror.

build-push.yml (image registry push) and ops-cron.yml (backup + IndexNow)
stay: neither duplicates anything in the real mirror, which faithfully
replicates the OLD git-checkout-and-build-in-place deploy model rather than
the registry-based one, and has no scheduled ops jobs at all.

.forgejo/workflows/ops-cron.yml

@@ -9,9 +9,12 @@ name: Ops cron (backup + IndexNow)
 # Both jobs SSH into the prod host and run inside the already-running compose
 # stack (docker compose exec), the same way deploy.sh already runs its own
 # post-deploy IndexNow ping -- no new network exposure, no separate dependency
-# install. Needs a runner registered with the `thermograph` label (Track B step
-# 5) and the same SSH secrets deploy.yml uses (SSH_HOST/SSH_USER/SSH_KEY/
-# SSH_PORT) to reach the prod host.
+# install. Runs on the `docker` label (the always-on Swarm-hosted runner
+# deploy/forgejo/ stood up) and reuses the same SSH secrets deploy.yml already
+# has (SSH_HOST/SSH_USER/SSH_KEY/SSH_PORT) -- inherits, and will automatically
+# benefit from a fix to, deploy.yml's own flagged branch/host mismatch (that
+# workflow's header comment: it still targets `main`, while
+# terraform.tfvars.example names prod's branch `release`).
 
 on:
   schedule:
@@ -22,10 +25,10 @@ on:
 jobs:
   backup:
     name: pg_dump backup
-    runs-on: [self-hosted, thermograph]
+    runs-on: docker
     steps:
       - name: Dump the prod database over SSH
-        uses: appleboy/ssh-action@v1.2.0
+        uses: https://github.com/appleboy/ssh-action@v1.2.0
         with:
           host: ${{ secrets.SSH_HOST }}
           username: ${{ secrets.SSH_USER }}
@@ -47,10 +50,10 @@ jobs:
 
   indexnow:
     name: IndexNow ping
-    runs-on: [self-hosted, thermograph]
+    runs-on: docker
     steps:
       - name: Ping IndexNow if the URL set changed
-        uses: appleboy/ssh-action@v1.2.0
+        uses: https://github.com/appleboy/ssh-action@v1.2.0
         with:
           host: ${{ secrets.SSH_HOST }}
           username: ${{ secrets.SSH_USER }}