Merge pull request 'ci: lock deploy workflow to nas-deploy runner' (#157) from chore/lock-nas-deploy into main

Reviewed-on: #157

.gitea/workflows/deploy-staging-live.yml

@@ -28,7 +28,7 @@ jobs:
   deploy:
     runs-on: nas-deploy
     container:
-      image: localhost:5000/archicratie/nas-deploy-node22@sha256:fefa8bb307005cebec07796661ab25528dc319c33a8f1e480e1d66f90cd5cff6
+      image: mcr.microsoft.com/devcontainers/javascript-node:22-bookworm
 
     steps:
       - name: Tools sanity
@@ -127,17 +127,25 @@ jobs:
             echo "ℹ️ no annotations/media change -> skip deploy"
           fi
 
-      - name: Toolchain sanity + resolve COMPOSE_PROJECT_NAME
+      - name: Install docker client + docker compose plugin (v2) + python yaml
         run: |
           set -euo pipefail
           source /tmp/deploy.env
           [[ "${GO:-0}" == "1" ]] || { echo "ℹ️ skipped"; exit 0; }
 
-          # tools are prebaked in the image
-          git --version
+          apt-get -o Acquire::Retries=5 -o Acquire::ForceIPv4=true update
+          apt-get install -y --no-install-recommends ca-certificates curl docker.io python3 python3-yaml
+          rm -rf /var/lib/apt/lists/*
+
+          mkdir -p /usr/local/lib/docker/cli-plugins
+          curl -fsSL \
+            "https://github.com/docker/compose/releases/download/v${COMPOSE_VERSION}/docker-compose-linux-x86_64" \
+            -o /usr/local/lib/docker/cli-plugins/docker-compose
+          chmod +x /usr/local/lib/docker/cli-plugins/docker-compose
+
           docker version
           docker compose version
-          python3 -c 'import yaml; print("PyYAML OK")'
+          python3 --version
 
           # Reuse existing compose project name if containers already exist
           PROJ="$(docker inspect archicratie-web-blue --format '{{ index .Config.Labels "com.docker.compose.project" }}' 2>/dev/null || true)"