ci: move image build off-infra to GHA -> ghcr (ADR-0002)

Generated by infra/scripts/offinfra-onboard: GHA builds+tests on the
GitHub mirror, pushes ghcr.io/viktorbarzin/claude-memory-mcp, then triggers the
Woodpecker deploy (repo 78). Old in-cluster build pipeline
removed: .woodpecker/build.yml .woodpecker/build-fallback.yml

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.woodpecker/deploy.yml

@@ -1,7 +1,9 @@
-# Manual-only targeted deploy of a specific tag (set IMAGE_NAME + IMAGE_TAG).
-# Push-driven deploys are handled by build.yml's deploy step now; this no longer
-# fires on push (its IMAGE_TAG-absent exit-78 used to red every push pipeline,
-# since build.yml + deploy.yml are workflows in the same pipeline run).
+# Auto-deploy, triggered ONLY by the GitHub Actions build POSTing to the
+# Woodpecker API (manual event, with IMAGE_TAG + IMAGE_NAME) after a successful
+# off-infra build+push to GHCR (ADR-0002). event:[manual] (NOT push) so the
+# Forgejo->GitHub mirror's raw pushes don't fire a spurious deploy.
+# The woodpecker-agent SA is cluster-admin — no kubeconfig needed.
+# Generated by infra/scripts/offinfra-onboard.
 when:
   - event: manual
 
@@ -9,11 +11,10 @@ steps:
   - name: check-vars
     image: alpine
     commands:
-      - "[ -n \"$IMAGE_TAG\" ] || (echo 'IMAGE_TAG not set, skipping deploy'; exit 78)"
+      - "[ -n \"$IMAGE_TAG\" ] || (echo 'IMAGE_TAG not set — refusing to deploy'; exit 1)"
 
   - name: deploy
     image: bitnami/kubectl:latest
     commands:
-      - "kubectl set image deployment/claude-memory claude-memory=${IMAGE_NAME}:${IMAGE_TAG} -n claude-memory"
-      - "kubectl rollout status deployment/claude-memory -n claude-memory --timeout=300s"
-
+      - "kubectl -n claude-memory set image deployment/claude-memory claude-memory=${IMAGE_NAME}:${IMAGE_TAG}"
+      - "kubectl -n claude-memory rollout status deployment/claude-memory --timeout=300s"