Scope CI/CD to build+test only; clean up runner infra

Remove automated deploy — Portainer handles deployments for now.
build.yml: deploy job removed, only builds and pushes image to registry.
infra/runner-compose.yml: clean standalone Portainer stack for act_runner,
  no swarm network dependency, uses external Forgejo URL.
infra/runner-swarm.yml: removed (replaced by runner-compose.yml).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.forgejo/workflows/build.yml

@@ -1,13 +1,15 @@
 # Runs only on pushes to main.
+# Builds the Docker image and pushes it to the Forgejo container registry.
+# Registry-side layer caching means unchanged layers (npm install, pip install)
+# are reused between builds — typically cuts build time from ~4 min to ~45 sec.
 #
-# The runner runs in the same swarm as Forgejo with /var/run/docker.sock mounted,
-# so it can build images and update swarm services directly — no SSH needed.
+# The resulting image can then be deployed manually via Portainer.
 #
 # Required secrets (repo → Settings → Secrets → Actions):
-#   REGISTRY_USER    — your Forgejo username
-#   REGISTRY_TOKEN   — Forgejo PAT with write:packages scope
-#   DEPLOY_SERVICE   — full swarm service name, e.g. fabledassistant_app
-name: Build & Deploy
+#   REGISTRY_USER   — your Forgejo username
+#   REGISTRY_TOKEN  — Forgejo PAT with write:packages scope (create at
+#                     git.fabledsword.com → Settings → Applications → Generate Token)
+name: Build & push image
 
 on:
   push:
@@ -19,7 +21,7 @@ env:
 
 jobs:
   build:
-    name: Build & push image
+    name: Build & push
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -42,31 +44,5 @@ jobs:
           tags: |
             ${{ env.IMAGE }}:latest
             ${{ env.IMAGE }}:${{ github.sha }}
-          # Registry-side layer cache — unchanged layers (npm install, pip install)
-          # are reused between builds. Cuts typical build time from ~4 min to ~45 sec.
           cache-from: type=registry,ref=${{ env.IMAGE }}:cache
           cache-to: type=registry,ref=${{ env.IMAGE }}:cache,mode=max
-
-  deploy:
-    name: Deploy
-    needs: build
-    runs-on: ubuntu-latest
-    steps:
-      - name: Log in to registry
-        run: |
-          echo "${{ secrets.REGISTRY_TOKEN }}" | \
-            docker login git.fabledsword.com -u "${{ secrets.REGISTRY_USER }}" --password-stdin
-
-      - name: Update swarm service
-        # --with-registry-auth forwards the login credentials to all swarm nodes
-        # so they can pull the new image. --detach=false waits for the rollout to
-        # complete before the job finishes (shows progress in the Actions log).
-        run: |
-          docker service update \
-            --image ${{ env.IMAGE }}:${{ github.sha }} \
-            --with-registry-auth \
-            --detach=false \
-            ${{ secrets.DEPLOY_SERVICE }}
-
-      - name: Clean up old images
-        run: docker image prune -f