ci: thin Woodpecker pipeline that runs the existing publishing scripts

Add .woodpecker.yml — install the pinned toolchain, run publishing/build.sh,
then publishing/deploy.sh. No build logic is duplicated; the publishing layer
stays the source of truth. Manual runs only for now: the push webhook is not
wired until the Woodpecker instance is restricted, connected to Gitea and
proven by a manual run.

.woodpecker.yml

@@ -0,0 +1,53 @@
+# Woodpecker CI pipeline for co-op/docs — THIN on purpose.
+#
+# It does NOT re-implement the build. The repository's publishing layer is the
+# single source of truth and this pipeline only wires it up:
+#
+#   publishing/requirements.txt  pinned MkDocs + Material toolchain
+#   publishing/build.sh          stage Markdown -> .site-src/, render .site-build/
+#   publishing/deploy.sh         push .site-build/ into the Cloudron Surfer app
+#
+# Any change to how the site is built belongs in publishing/, never here.
+#
+# Run model: MANUAL ONLY for now. The Gitea webhook that fires this on push is
+# deliberately NOT wired yet — the Woodpecker instance must first be restricted
+# (done), connected to Gitea via OAuth (pending, see the operator runbook), and
+# proven by a manual run. Once those hold, add `push` to the `when` block below
+# and register the webhook in Gitea.
+#
+# Secrets required (Woodpecker repo/org secret, name `cloudron_token`):
+#   cloudron_token = the Cloudron API token used by publishing/deploy.sh
+# Do not put credentials in this file.
+
+when:
+  - event: manual
+
+steps:
+  - name: install
+    image: python:3.12-slim-bookworm
+    commands:
+      # Pinned toolchain — the same file publishing/build.sh installs into its
+      # own .venv-docs. We pre-create that venv so build.sh reuses it verbatim.
+      - python3 -m venv .venv-docs
+      - .venv-docs/bin/pip install --quiet --upgrade pip
+      - .venv-docs/bin/pip install --quiet -r publishing/requirements.txt
+
+  - name: build
+    image: python:3.12-slim-bookworm
+    commands:
+      # Reuses .venv-docs created above; build.sh only installs if it is missing.
+      - publishing/build.sh
+
+  - name: deploy
+    image: node:20-bookworm-slim
+    commands:
+      # deploy.sh drives the Cloudron `cloudron` CLI (a node script) via
+      # `cloudron exec`; it needs node, the CLI, bash, git and tar.
+      - apt-get update
+      - apt-get install -y --no-install-recommends bash git tar ca-certificates
+      - npm install -g cloudron
+      # Deploy the build produced by the `build` step above (shared workspace).
+      - publishing/deploy.sh
+    environment:
+      CLOUDRON_TOKEN:
+        from_secret: cloudron_token