ci: promote bot to a 'deploy' image channel only on [deploy] trigger

The production bot tracks a separate image, conjurer-bot-deploy, so it
updates only when a commit message contains [deploy] - the test bot and
librarian keep updating on every build. On a [deploy] commit the already-
built conjurer-bot:<sha> is re-tagged (same bytes, no rebuild) and pushed
as conjurer-bot-deploy:<sha>; the deploy repo's image-updater tracks that.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/build.yaml

@@ -22,6 +22,23 @@ jobs:
           docker build -f docker/Dockerfile.bot       -t gitea.czernobog.pl/gitea/conjurer-bot:$TAG .
           docker push  gitea.czernobog.pl/gitea/conjurer-bot:$TAG
 
+      # DEPLOY channel: the production (deploy) bot tracks a SEPARATE image,
+      # conjurer-bot-deploy, which only gets a new tag when the commit message
+      # contains the trigger "[deploy]". So the test bot & librarian update on
+      # every build, but the deploy bot only on commits you explicitly promote.
+      # Same bytes as conjurer-bot:$TAG - just re-tagged, no rebuild.
+      - name: Promote bot to deploy channel (only on [deploy] in commit message)
+        run: |
+          TAG=${GITHUB_SHA::8}
+          MSG="$(git log -1 --pretty=%B)"
+          if echo "$MSG" | grep -qiF '[deploy]'; then
+            echo "Commit message contains [deploy] -> promoting conjurer-bot-deploy:$TAG"
+            docker tag  gitea.czernobog.pl/gitea/conjurer-bot:$TAG gitea.czernobog.pl/gitea/conjurer-bot-deploy:$TAG
+            docker push gitea.czernobog.pl/gitea/conjurer-bot-deploy:$TAG
+          else
+            echo "No [deploy] trigger in commit message -> deploy bot image left unchanged"
+          fi
+
       # Docker-owe: musician i share lekkie, radio CIĘŻKIE (opam+OCaml+liquidsoap)
       - name: Build docker-stack images (musician, share)
         run: |