Deploy site: publish to the registry before the s1 steps

Run 73 could not reach s1 at all (ssh-keyscan failed three times, the
runner's address is probably banned there), and with the upload last
that held back bkk01's release too. Publishing comes first now; s1 keeps
getting the same build while it answers.

.gitea/workflows/deploy-site.yml

@@ -43,6 +43,28 @@ jobs:
       - name: Build site/dist
         run: bash site/build.sh
 
+      - name: Publish to the package registry (bkk01)
+        # bkk01 serves cnxvinyl.lol from releases in the B4L package registry
+        # (cnx-network-clan, docs/src/s1-migration.md): the package event
+        # makes it fetch this version within seconds. Until DNS moves to
+        # bkk01, s1 below stays the live server and gets the same build.
+        # First, so a failing s1 step cannot hold back bkk01's release.
+        # REGISTRY_USER / REGISTRY_TOKEN: organization secrets, an account
+        # with a write:package token in a B4L team that may write packages.
+        env:
+          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+        run: |
+          if [ -z "$REGISTRY_USER" ] || [ -z "$REGISTRY_TOKEN" ]; then
+            echo "::error::REGISTRY_USER and REGISTRY_TOKEN must be set as organization secrets"
+            exit 1
+          fi
+          version="$(date -u +%Y%m%dT%H%M%S)-${GITHUB_SHA::12}"
+          tar -czf site.tar.gz -C site/dist .
+          curl -fsS --user "$REGISTRY_USER:$REGISTRY_TOKEN" --upload-file site.tar.gz \
+            "${{ github.server_url }}/api/packages/${{ github.repository_owner }}/generic/cnxvinyl.lol/$version/site.tar.gz"
+          echo "published cnxvinyl.lol $version ($(du -h site.tar.gz | cut -f1))"
+
       - name: Set up SSH
         env:
           VPS_SSH_KEY: ${{ secrets.VPS_SSH_KEY }}
@@ -115,27 +137,6 @@ jobs:
           echo "live on server: $live"
           [ "$live" = "$(cat site/dist/version.txt)" ] || { echo "::error::server holds $live, expected $(cat site/dist/version.txt)"; exit 1; }
 
-      - name: Publish to the package registry (bkk01)
-        # bkk01 serves cnxvinyl.lol from releases in the B4L package registry
-        # (cnx-network-clan, docs/src/s1-migration.md): the package event
-        # makes it fetch this version within seconds. Until DNS moves to
-        # bkk01, s1 above stays the live server and gets the same build.
-        # REGISTRY_USER / REGISTRY_TOKEN: organization secrets, an account
-        # with a write:package token in a B4L team that may write packages.
-        env:
-          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
-          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
-        run: |
-          if [ -z "$REGISTRY_USER" ] || [ -z "$REGISTRY_TOKEN" ]; then
-            echo "::error::REGISTRY_USER and REGISTRY_TOKEN must be set as organization secrets"
-            exit 1
-          fi
-          version="$(date -u +%Y%m%dT%H%M%S)-${GITHUB_SHA::12}"
-          tar -czf site.tar.gz -C site/dist .
-          curl -fsS --user "$REGISTRY_USER:$REGISTRY_TOKEN" --upload-file site.tar.gz \
-            "${{ github.server_url }}/api/packages/${{ github.repository_owner }}/generic/cnxvinyl.lol/$version/site.tar.gz"
-          echo "published cnxvinyl.lol $version ($(du -h site.tar.gz | cut -f1))"
-
       - name: Check the public URL
         # Warning only: DNS or a basic_auth login can make this
         # fail while the files on the server are already correct.