build(ci,deploy)!: the runner at home in a nightly window, deploys by hand (ADR 0039, D6, D13, D16)

The CI runner moves to halkyon.li's host at home and runs from 02:00 to
05:00 alone: a timer starts it, its unit's RuntimeMaxSec ends it, and
night.sh rests the instance's heavy sidecars around it as deploy, while
Caddy, PostgreSQL and the apps' servers keep serving. Jobs pushed during the
day wait in Forgejo's queue.

Its sandbox fits the new host: its folder on the HDD, the rest of /data
hidden, containerd's store out of reach, no private IPv4 network and no
IPv6 at all (the home network's IPv6 addresses are public ones under a
changing prefix, on the internet's own interface), 5 GB of memory with swap
beyond. The Sandbox step checks the tunnel, the home router and IPv6.

BREAKING CHANGE: CI deploys nothing any more: the deploy job goes with
learn.halkyon.eu's server, and halkyon.li deploys by hand with redeploy.sh
once a commit's night's run passed. Jobs run on the runner labelled
balthasar; sahaquiel's runner picks up none.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

docs/adr/0039-halkyon-li-at-home.md

@@ -148,13 +148,15 @@
   `compose.jellyfin-home.yaml` go, with ADR 0032's open question.
 - **D16 The runner on balthasar**: `deploy/runner/`'s unit as it is (its own user, no
   `/home`, no Docker socket, Docker's networks denied), with these changes:
-  - its folder on the HDD outside `/home`;
-  - the home network denied by interface rather than by address, so Vodafone's
-    changing IPv6 prefix is covered too;
-  - the tunnel's `10.61.97.0/30` denied;
-  - the timer's window (D6).
-
-  CI's `runs-on` and the Sandbox step's checks follow it.
+  - its folder on the HDD, `/data/forgejo-runner`, seen as `/var/lib/forgejo-runner`;
+    the rest of `/data`, where `/home` really lies, hidden from it;
+  - no IPv6 at all, and no private IPv4 network (`10.0.0.0/8`, which holds the tunnel,
+    among them). Corrected while building: the proposal had the home network denied by
+    interface, but the home network and the internet come through the same one, and the
+    home network's IPv6 addresses are public ones under a prefix Vodafone changes. Every
+    host CI fetches from answers over IPv4;
+  - the timer's window (D6), and memory to fit beside the instance: 5 GB, swap beyond;
+  - CI's `runs-on` (`balthasar`) and the Sandbox step's checks following it.
 
 ### Decided after the proposal (8 Nov 2026)