Keep the deploy key out of the printed CI script

The deploy step put ${{ secrets.DEPLOY_SSH_KEY }} straight into the run script. The runner prints that script, and Gitea does not mask a multi-line secret once it is split across script lines, so the key body appeared in every deploy log. The key now arrives through the step's env block.

.gitea/workflows/build-next.yml

@@ -119,9 +119,14 @@ jobs:
       # failure only warns: the image is pushed and the midnight
       # podman-update.timer deploys it anyway.
       - name: Trigger immediate deploy
+        # The key comes in through env, not ${{ secrets.* }} in the script:
+        # the runner prints the script, and Gitea does not mask a multi-line
+        # secret once it is split across script lines.
+        env:
+          DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
         run: |
           install -m600 /dev/null "$HOME/.deploy_key"
-          printf '%s\n' "${{ secrets.DEPLOY_SSH_KEY }}" > "$HOME/.deploy_key"
+          printf '%s\n' "$DEPLOY_SSH_KEY" > "$HOME/.deploy_key"
           ssh -i "$HOME/.deploy_key" \
               -o BatchMode=yes \
               -o StrictHostKeyChecking=accept-new \