ci(pages): self-managed Actions deploy on Node 24; drop built-in builder

Switch Pages source to GitHub Actions with a deploy workflow we control, using
current (Node-24) actions — removes the Node-20 deprecation warning from the
built-in builder and the intermittent deploy timeout. Fetches the signed appcast
from the latest release at deploy time (no commit), replacing the sync workflow.

Author: barscn

.github/workflows/deploy.yml

@@ -0,0 +1,52 @@
+name: Deploy Pages
+
+# Self-managed GitHub Pages deploy (Pages source = "GitHub Actions"). We control the action
+# versions — all on Node 24 — so there's no Node-20 deprecation warning from the built-in
+# builder, and we own the deploy step (which the managed one intermittently timed out on).
+#
+# It also publishes the Sparkle appcast: the signed appcast.xml is fetched from the latest
+# Capsule release at deploy time and shipped with the site (no git commit needed). The schedule
+# keeps the feed fresh even without a push; every push redeploys immediately.
+on:
+  push:
+    branches: [main]
+  schedule:
+    - cron: "*/15 * * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+# Never cancel an in-progress deploy; let each finish so the site is always consistent.
+concurrency:
+  group: pages
+  cancel-in-progress: false
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Pull latest signed appcast from the Capsule release
+        run: |
+          url="https://github.com/capsule-native/capsule/releases/latest/download/appcast.xml"
+          if curl -fsSL "$url" -o appcast.xml; then
+            echo "appcast.xml updated from the latest release."
+          else
+            echo "No published appcast on the latest release yet — shipping the placeholder."
+          fi
+
+      - uses: actions/configure-pages@v6
+
+      - uses: actions/upload-pages-artifact@v5
+        with:
+          path: .
+
+      - id: deployment
+        uses: actions/deploy-pages@v5

.github/workflows/sync-appcast.yml

@@ -6,9 +6,14 @@ hosts the landing page and the **Sparkle appcast** the app polls for auto-update
 - **Appcast feed:** <https://capsule-native.github.io/appcast.xml> — this is the app's `SUFeedURL`.
 - `appcast.xml` is generated and **EdDSA-signed** by the release pipeline in
   [`capsule-native/capsule`](https://github.com/capsule-native/capsule) and attached to each
-  GitHub Release. The [**Sync appcast**](.github/workflows/sync-appcast.yml) workflow here pulls
-  the latest release's `appcast.xml` and commits it, which republishes the feed via Pages.
+  GitHub Release. The [**Deploy Pages**](.github/workflows/deploy.yml) workflow here fetches that
+  signed `appcast.xml` from the latest release **at deploy time** and ships it with the site — no
+  commit — then publishes via GitHub Pages.
 
-> Do not edit `appcast.xml` by hand — the sync workflow overwrites it. To publish immediately
-> after cutting a release, run the **Sync appcast** workflow (Actions ▸ Sync appcast ▸ Run
-> workflow); otherwise it syncs automatically within ~15 minutes.
+The site is deployed by our own GitHub Actions workflow (Pages source = **GitHub Actions**), not
+the built-in Jekyll builder, so we control the action versions and the deploy step. It runs on
+every push to `main`, on a ~15-minute schedule (to pick up new releases), and on demand.
+
+> The committed `appcast.xml` is only a placeholder — the deploy overwrites it with the latest
+> release's signed feed. To publish immediately after cutting a release, run **Deploy Pages**
+> (Actions ▸ Deploy Pages ▸ Run workflow); otherwise the schedule refreshes it within ~15 minutes.