ci: secure rsync deployments

[tiye]

Follow-up for the deployment security review that arrived after #9 was merged.

Changes

• replace both Pendect/action-rsyncer deployments
• build rsync 3.4.4 from the official Samba source tarball after SHA-256 verification
• pin the tiye.me ED25519 host key and enforce strict host-key checking
• write the deployment key only after known_hosts is configured
• preserve the existing web and mdBook deployment targets

The repository continues to track only the canonical calcit.cirru snapshot; no compact.cirru is present.

Validation

• git diff --check
• both deployment call sites use the verified rsync binary and strict SSH options

[coderabbitai]

Warning

Review limit reached

Next included review available in 48 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Team

Run ID: 6a658889-848d-4c47-bd48-a5420b1c4d99

📥 Commits

Reviewing files that changed from the base of the PR and between 8ab9b03 and c9704c6.

📒 Files selected for processing (1)

• .github/workflows/upload.yaml

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}