CI: build and open the petersweb-infra PR with quine-global/site-image

Replaces .gitea/workflows/ci.yml with .forgejo/workflows/deploy.yml,
the shared action's version of the same flow, on the same arm64
ubuntu-latest runner and privileged Podman container.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.forgejo/workflows/deploy.yml

@@ -0,0 +1,38 @@
+# On every push to main: build the image, push it to the forge's registry,
+# and open a petersweb-infra PR that pins it (quine-global/site-image).
+# Merging that PR deploys it.
+#
+# Runs on the forge VM's ubuntu-latest runner, which is arm64 like the VM
+# the site runs on, in a privileged Podman container (vfs storage).
+name: deploy
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+jobs:
+  image:
+    runs-on: ubuntu-latest
+    container:
+      image: quay.io/podman/stable
+      options: --privileged
+    env:
+      STORAGE_DRIVER: vfs
+    steps:
+      - name: Tools
+        run: dnf install -y --quiet git-core jq curl
+      # A plain clone: the container has no Node for actions/checkout.
+      - name: Checkout
+        run: |
+          git clone -q "https://ci:${{ github.token }}@${GITHUB_SERVER_URL#https://}/${{ github.repository }}.git" .
+          git checkout -q "${{ github.sha }}"
+      - uses: https://forge.quinefoundation.com/quine-global/site-image@v1
+        with:
+          image: forge.quinefoundation.com/cold-air-networks/customer-riverside
+          infra-file: nixos/arion-riverside/arion-compose.nix
+          name: riverside
+          platform: linux/arm64
+          registry-username: ${{ secrets.REGISTRY_USERNAME }}
+          registry-password: ${{ secrets.REGISTRY_PASSWORD }}
+          infra-token: ${{ secrets.INFRA_TOKEN }}