fix: harden ci, don't log any kamal stuff here, it's a liability

.github/workflows/server.yml

@@ -150,29 +150,30 @@ jobs:
           cache-from: type=gha,scope=server-${{ github.ref_name }}
           cache-to: type=gha,mode=max,scope=server-${{ github.ref_name }}
 
-  deploy:
+  dispatch-deploy:
+    # Fire a repository_dispatch at tachi-deploy (private). That repo's workflow
+    # owns the SSH key and Kamal output — keeping deploy logs out of this
+    # public repo. See tachi-deploy/.github/workflows/deploy.yml.
     runs-on: ubuntu-latest
     needs: [test, docker-push]
     if: ${{ github.ref == 'refs/heads/main' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') }}
     strategy:
       fail-fast: false
-      max-parallel: 1
       matrix:
         destination: [boku, kamai, dev]
     permissions:
       contents: read
     steps:
-      - name: Enable SSH
+      - name: Dispatch deploy
         env:
-          SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
-          SSH_KNOWN_HOSTS: ${{ secrets.SSH_KNOWN_HOSTS }}
+          # Fine-grained PAT, repo-scoped to zkldi/tachi-deploy, Contents: write.
+          GH_TOKEN: ${{ secrets.DEPLOY_DISPATCH_TOKEN }}
+          DEST: ${{ matrix.destination }}
+          SHA: ${{ github.sha }}
         run: |
-          mkdir -p ~/.ssh
-          printf '%s' "$SSH_PRIVATE_KEY" > ~/.ssh/id_rsa
-          chmod 600 ~/.ssh/id_rsa
-          printf '%s' "$SSH_KNOWN_HOSTS" > ~/.ssh/known_hosts
-
-      - name: Deploy on server
-        env:
-          TACHI_HOST: ${{ secrets.TACHI_HOST }}
-        run: ssh "ci@${TACHI_HOST}" "/home/ci/tachi-deploy/operations/deploy.sh server ${{ matrix.destination }} ${{ github.sha }}"
+          gh api repos/zkldi/tachi-deploy/dispatches \
+            -f event_type=deploy \
+            -F "client_payload[app]=server" \
+            -F "client_payload[dest]=${DEST}" \
+            -F "client_payload[sha]=${SHA}"
+          echo "::notice::Dispatched server@${DEST} ${SHA} — logs: https://github.com/zkldi/tachi-deploy/actions/workflows/deploy.yml"