fix: harden ci, don't log any kamal stuff here, it's a liability

.github/workflows/github-bot.yml

@@ -57,22 +57,20 @@ jobs:
           cache-from: type=gha,scope=${{ github.ref_name }}-github-bot
           cache-to: type=gha,mode=max,scope=${{ github.ref_name }}-github-bot
 
-  deploy:
+  dispatch-deploy:
+    # See server.yml for rationale — deploy logs live in the private tachi-deploy repo.
     runs-on: ubuntu-latest
     needs: [docker-push]
     if: ${{ github.ref == 'refs/heads/main' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') }}
     steps:
-      - name: Enable SSH
+      - name: Dispatch deploy
         env:
-          SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
-          SSH_KNOWN_HOSTS: ${{ secrets.SSH_KNOWN_HOSTS }}
+          GH_TOKEN: ${{ secrets.DEPLOY_DISPATCH_TOKEN }}
+          SHA: ${{ github.sha }}
         run: |
-          mkdir -p ~/.ssh
-          printf '%s' "$SSH_PRIVATE_KEY" > ~/.ssh/id_rsa
-          chmod 600 ~/.ssh/id_rsa
-          printf '%s' "$SSH_KNOWN_HOSTS" > ~/.ssh/known_hosts
-
-      - name: Deploy updates
-        env:
-          TACHI_HOST: ${{ secrets.TACHI_HOST }}
-        run: ssh "ci@${TACHI_HOST}" "/home/ci/tachi-deploy/operations/deploy.sh ghbot - ${{ github.sha }}"
+          gh api repos/zkldi/tachi-deploy/dispatches \
+            -f event_type=deploy \
+            -F "client_payload[app]=ghbot" \
+            -F "client_payload[dest]=-" \
+            -F "client_payload[sha]=${SHA}"
+          echo "::notice::Dispatched ghbot ${SHA} — logs: https://github.com/zkldi/tachi-deploy/actions/workflows/deploy.yml"