fix(ci): drop Build & Import / Deploy via GitOps jobs (jepa-fx-risk#19)

This is a research repo -- issue#6/#7 already decided CI should be
check-only (`task check` on push/PR), no build, no image push, no
deploy, since training runs are manual/GPU-bound and never CI-triggered.
That never actually landed in cd.yml: it still carried the original
go-web template's build+deploy jobs verbatim, still referencing the
pre-rename `hostexecutor` name (`./cmd/hostexecutor` doesn't exist --
real dirs are cmd/eval, cmd/jepa-fx-risk) and a `k3s/apps/hostexecutor`
deployment that was never created in infra (confirmed: no manifest
exists under either name). Once the check job's own Taskfile bug was
fixed, build started actually running and failing on the wrong path.
Removed both jobs -- check is the only gate this repo needs.

.gitea/workflows/cd.yml

@@ -7,9 +7,6 @@ on:
   pull_request:
     branches: [main]
 
-env:
-  IMAGE: hostexecutor
-
 jobs:
   check:
     name: Lint / Test / Vet
@@ -31,85 +28,3 @@ jobs:
 
       - name: Run checks
         run: task check
-
-  build:
-    name: Build & Import
-    needs: check
-    runs-on: self-hosted
-    if: github.event_name != 'pull_request'
-    outputs:
-      image-tag: ${{ steps.meta.outputs.sha-tag }}
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Derive image tags
-        id: meta
-        run: |
-          SHA=$(git rev-parse --short HEAD)
-          echo "sha-tag=${SHA}" >> "$GITHUB_OUTPUT"
-
-      - name: Build and push to local registry
-        run: |
-          REGISTRY="localhost:5000"
-          REF="${REGISTRY}/${{ env.IMAGE }}:${{ steps.meta.outputs.sha-tag }}"
-          buildah build \
-            --label "org.opencontainers.image.revision=${{ github.sha }}" \
-            -t ${REF} \
-            -t ${REGISTRY}/${{ env.IMAGE }}:latest \
-            .
-          buildah push --tls-verify=false ${REF}
-          buildah push --tls-verify=false ${REGISTRY}/${{ env.IMAGE }}:latest
-          echo "✓ Image pushed to ${REF}"
-
-  deploy:
-    name: Deploy via GitOps
-    needs: build
-    runs-on: self-hosted
-    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
-    steps:
-      - name: Update image tag in infra repo
-        env:
-          IMAGE_TAG: ${{ needs.build.outputs.image-tag }}
-          DEPLOY_KEY: ${{ secrets.INFRA_DEPLOY_KEY }}
-        run: |
-          set -euo pipefail
-          mkdir -p ~/.ssh
-          echo "$DEPLOY_KEY" > ~/.ssh/id_infra
-          chmod 600 ~/.ssh/id_infra
-          ssh-keyscan -p 30022 10.0.1.20 >> ~/.ssh/known_hosts 2>/dev/null
-          export GIT_SSH_COMMAND="ssh -i ~/.ssh/id_infra -o IdentitiesOnly=yes"
-          rm -rf /tmp/infra
-          git clone -b main ssh://git@10.0.1.20:30022/mathias/infra.git /tmp/infra
-          cd /tmp/infra
-          DEPLOYMENT="k3s/apps/hostexecutor/deployment.yaml"
-          sed -i "s|image: localhost:5000/hostexecutor:.*|image: localhost:5000/hostexecutor:${IMAGE_TAG}|" "$DEPLOYMENT"
-          grep -q "localhost:5000/hostexecutor:${IMAGE_TAG}" "$DEPLOYMENT" \
-            || { echo "✗ image tag patch failed"; exit 1; }
-          if git diff --quiet "$DEPLOYMENT"; then
-            echo "ℹ image tag unchanged — skipping push"
-          else
-            git -c user.name="hostexecutor CI" \
-                -c user.email="ci@hostexecutor.local" \
-                commit -m "chore(deploy): hostexecutor → ${IMAGE_TAG}" "$DEPLOYMENT"
-            git push origin main
-            echo "✓ pushed to infra repo"
-          fi
-          shred -u ~/.ssh/id_infra
-
-      - name: Trigger Flux reconcile
-        run: |
-          kubectl -n flux-system annotate gitrepository flux-system \
-            reconcile.fluxcd.io/requestedAt="$(date +%s)" --overwrite
-          kubectl -n flux-system annotate kustomization apps \
-            reconcile.fluxcd.io/requestedAt="$(date +%s)" --overwrite
-
-      - name: Verify rollout
-        run: |
-          kubectl rollout status deployment/hostexecutor \
-            --namespace hostexecutor \
-            --timeout=120s \
-          || {
-            kubectl get pods -n hostexecutor -o wide
-            kubectl get events -n hostexecutor --sort-by='.lastTimestamp' | tail -20
-            exit 1
-          }