The deploying pipeline stays on Forgejo, where the runner can reach the cluster.
This one only scans for secrets and runs vet, test and lint, so the mirrored
repo shows its own checks without ever needing a secret. Go steps no-op until
apps/api/go.mod exists.
