fix CI deploy: use global SSH config for deploy-rs

The nix-daemon runs as root and cannot access the gitea-runner user's
~/.ssh directory. Solution: write the deploy key and SSH config to
/etc/deploy/ and /etc/ssh/ssh_config.d/ which are readable by all
users including the nix-daemon.

- Deploy key is written to /etc/deploy/key (cleaned up after deploy)
- SSH config in /etc/ssh/ssh_config.d/deploy.conf (cleaned up after)
- Minimal NOPASSWD sudo rules for gitea-runner to manage these files
- Reverts local deploy approach, back to deploy-rs over SSH

modules/nixos/forgejo-runner/default.nix

@@ -31,10 +31,13 @@ in
   config = mkIf cfg.enable {
     nix.settings.trusted-users = [ "gitea-runner" ];
 
-    # Allow gitea-runner to deploy system configurations without password
+    # Allow gitea-runner to manage deploy keys and SSH config for CI/CD
     security.sudo.extraConfig = ''
-      gitea-runner ALL=(root) NOPASSWD: /run/current-system/sw/bin/nix-env -p /nix/var/nix/profiles/system --set *
-      gitea-runner ALL=(root) NOPASSWD: /nix/store/*/bin/switch-to-configuration *
+      gitea-runner ALL=(root) NOPASSWD: /run/current-system/sw/bin/tee /etc/deploy/key
+      gitea-runner ALL=(root) NOPASSWD: /run/current-system/sw/bin/tee /etc/ssh/ssh_config.d/deploy.conf
+      gitea-runner ALL=(root) NOPASSWD: /run/current-system/sw/bin/mkdir -p /etc/deploy
+      gitea-runner ALL=(root) NOPASSWD: /run/current-system/sw/bin/chmod 600 /etc/deploy/key
+      gitea-runner ALL=(root) NOPASSWD: /run/current-system/sw/bin/rm -f /etc/deploy/key /etc/ssh/ssh_config.d/deploy.conf
     '';
 
     services.gitea-actions-runner = {