ci: consolidate release tokens to single DEPLOY_TOKEN, rename redeploy step

- Use one DEPLOY_TOKEN for both registry login and Gitea release API,
  matching the claude-code-facts convention.
- Rename "Trigger Portainer redeploy" to "Trigger redeploy webhook" —
  the step calls a generic DOCKER_REDEPLOY_WEBHOOK_URL, not a
  Portainer-specific endpoint.
- Add .facts-sync.json to pin this project to the facts repo commit.

.gitea/workflows/release.yml

@@ -41,7 +41,7 @@ jobs:
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ gitea.actor }}
-          password: ${{ secrets.REGISTRY_TOKEN }}
+          password: ${{ secrets.DEPLOY_TOKEN }}
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
@@ -58,14 +58,14 @@ jobs:
           cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache
           cache-to: type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache,mode=max
 
-      - name: Trigger Portainer redeploy
+      - name: Trigger redeploy webhook
         if: steps.version.outputs.is_pre == 'false'
         continue-on-error: true
         run: |
           if [ -n "${{ secrets.DOCKER_REDEPLOY_WEBHOOK_URL }}" ]; then
-            echo "Triggering Portainer redeploy..."
+            echo "Triggering redeploy webhook..."
             curl -sf -X POST "${{ secrets.DOCKER_REDEPLOY_WEBHOOK_URL }}" \
-              --max-time 30 || echo "::warning::Portainer webhook failed"
+              --max-time 30 || echo "::warning::Redeploy webhook failed"
           else
             echo "DOCKER_REDEPLOY_WEBHOOK_URL not set — skipping auto-deploy"
           fi
@@ -83,7 +83,7 @@ jobs:
 
       - name: Create Gitea Release
         env:
-          RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
+          DEPLOY_TOKEN: ${{ secrets.DEPLOY_TOKEN }}
         run: |
           TAG="${{ steps.version.outputs.tag }}"
           VERSION="${{ steps.version.outputs.version }}"
@@ -114,7 +114,7 @@ jobs:
           ")
 
           RELEASE=$(curl -s -X POST "$BASE_URL/releases" \
-            -H "Authorization: token $RELEASE_TOKEN" \
+            -H "Authorization: token $DEPLOY_TOKEN" \
             -H "Content-Type: application/json" \
             -d "{
               \"tag_name\": \"$TAG\",
@@ -129,7 +129,7 @@ jobs:
           if [ -z "$RELEASE_ID" ]; then
             echo "::warning::Release already exists for tag $TAG — reusing existing release"
             RELEASE=$(curl -s "$BASE_URL/releases/tags/$TAG" \
-              -H "Authorization: token $RELEASE_TOKEN")
+              -H "Authorization: token $DEPLOY_TOKEN")
             RELEASE_ID=$(echo "$RELEASE" | python3 -c "import sys,json; print(json.load(sys.stdin)['id'])")
           fi
           echo "Created release $RELEASE_ID for $TAG"