Deploy site: also publish each build to the package registry for bkk01

cnxvinyl.lol moves from s1 to bkk01 (cnx-network-clan, TODO section 18,
docs/src/s1-migration.md). After the rsync to s1 the job uploads
site/dist as site.tar.gz, generic package B4L/cnxvinyl.lol, version
<UTC time>-<commit>, as b4l-ci (organization secrets REGISTRY_USER and
REGISTRY_TOKEN); the package event makes bkk01 fetch it. s1 stays the
live server until DNS moves; then the SSH steps and VPS_* secrets go.

.gitea/workflows/deploy-site.yml

@@ -108,6 +108,27 @@ jobs:
           echo "live on server: $live"
           [ "$live" = "$(cat site/dist/version.txt)" ] || { echo "::error::server holds $live, expected $(cat site/dist/version.txt)"; exit 1; }
 
+      - name: Publish to the package registry (bkk01)
+        # bkk01 serves cnxvinyl.lol from releases in the B4L package registry
+        # (cnx-network-clan, docs/src/s1-migration.md): the package event
+        # makes it fetch this version within seconds. Until DNS moves to
+        # bkk01, s1 above stays the live server and gets the same build.
+        # REGISTRY_USER / REGISTRY_TOKEN: organization secrets, an account
+        # with a write:package token in a B4L team that may write packages.
+        env:
+          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+        run: |
+          if [ -z "$REGISTRY_USER" ] || [ -z "$REGISTRY_TOKEN" ]; then
+            echo "::error::REGISTRY_USER and REGISTRY_TOKEN must be set as organization secrets"
+            exit 1
+          fi
+          version="$(date -u +%Y%m%dT%H%M%S)-${GITHUB_SHA::12}"
+          tar -czf site.tar.gz -C site/dist .
+          curl -fsS --user "$REGISTRY_USER:$REGISTRY_TOKEN" --upload-file site.tar.gz \
+            "${{ github.server_url }}/api/packages/${{ github.repository_owner }}/generic/cnxvinyl.lol/$version/site.tar.gz"
+          echo "published cnxvinyl.lol $version ($(du -h site.tar.gz | cut -f1))"
+
       - name: Check the public URL
         # Warning only: DNS or a basic_auth login can make this
         # fail while the files on the server are already correct.