fix: hold candidate traffic and workers until migration commit

.gitea/workflows/managed-validation.yml

@@ -1,8 +1,6 @@
 name: Managed validation
 
 on:
-  push:
-    branches: [main]
   pull_request:
   workflow_dispatch:
     inputs:
@@ -25,7 +23,7 @@ jobs:
     name: full
     # Public fork code must never execute automatically on the private runner.
     if: ${{ gitea.event_name != 'pull_request' || gitea.event.pull_request.head.repo.full_name == gitea.repository }}
-    runs-on: linux-validation
+    runs-on: ubuntu-latest
     timeout-minutes: 30
     container:
       # Gitea's JavaScript actions execute inside the job container, so use

.gitea/workflows/release.yml

@@ -7,7 +7,7 @@ on:
 
 jobs:
   verify-publish:
-    runs-on: linux-validation
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
       - name: Install pinned uv

.gitea/workflows/unraid-deploy.yml

@@ -0,0 +1,31 @@
+name: Unraid autoredeploy
+
+on:
+  push:
+    branches: [main]
+    paths-ignore:
+      - ".gitea/**"
+      - "docs/**"
+      - "**/*.md"
+  workflow_dispatch:
+
+concurrency:
+  group: unraid-production-vacatureradar
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
+jobs:
+  deploy:
+    name: Deploy vacatureradar
+    runs-on: unraid-deploy
+    timeout-minutes: 180
+    steps:
+      - name: Deploy exact Gitea revision
+        run: |
+          set -euo pipefail
+          docker exec gitea-deploy-control \
+            /opt/gitea-deploy/deploy.py deploy \
+            "$GITHUB_REPOSITORY" "$GITHUB_SHA"
+