The OSS public-scrub removed .forgejo/workflows/ wholesale — it only needed
to parameterize the two infra literals in the publish step. Restored both
workflows; the publish target (root@host) and its SSH host-key now come from
Forgejo repo secrets (STRAW_PUBLISH_TARGET / STRAW_LUCY_HOSTKEY) instead of
literals, so the public workflow carries zero infra topology. Everything else
was already clean: signing keystore + deploy key are secrets, the actual
publish is a forced-command on the host (not in this YAML), and the runner
label / build image / signer fingerprint are non-sensitive.
Restores push-triggered CI: build assembleDebug in the straw-build image,
verify signer bb9ca96b, publish to fdroid. This push also builds vc=91.
