fix: complete open-source delivery and isolate community CI

docs/PUBLICATION.md

@@ -4,7 +4,9 @@ Runtime keys, passwords, sessions, private photos, databases and local `.env` fi
 must remain outside Git. Examples use documentation-only addresses and identities.
 Personal deployment reports and screenshots are excluded from public history.
 
-The NAS Docker runner accepts trusted repository events only. External fork PRs
+The Gitea NAS Docker runner accepts trusted repository events only. GitHub mirrors
+use the separate community workflow on GitHub-hosted disposable runners, with
+read-only repository permissions and no deployment configuration. External fork PRs
 are not executed on this runner; maintainers must review them before copying changes
 to a trusted branch. All lint, type, test, audit and isolated Docker checks remain.
 

docs/deployment/GITEA_CD.md

@@ -1,4 +1,11 @@
-# Gitea Actions production CD v1
+# Gitea Actions production CD v1 (historical)
+
+> This NAS production deployment procedure is retired. Current Gitea Actions
+> only runs isolated verification; production uses the maintainer-specific
+> Ubuntu workflow in `scripts/server-release.py`. For a new installation use
+> the Docker Compose instructions in README.md. Filesystem/NFS photo sources
+> are disabled; use Synology Photos API or WebDAV. The configuration below is
+> retained for historical reference and must not be used for new deployments.
 
 ## Audit and adoption boundary