fix(host,sync): publish lists readable by nginx, and push the sync over a deploy key (#5)

The first publish on phishing.pezkuwichain.io copied the stage directory's
0700 mode onto the web root with rsync -a, and every list answered 403 until
the modes were put back by hand, about three minutes later. The publish script
now sets modes (--chmod=D755,F644), and test-publish.sh checks the web root's
directories are 755 and the lists 644; without --chmod it fails.

master is now protected by a ruleset (pull request, "lists" required). GitHub
refuses the Actions app as a bypass actor, so the sync's github.token push
would have been rejected. The sync now pushes over a write deploy key, the
repository's only one, kept as a secret of a "sync" environment that runs for
master only; the ruleset exempts deploy keys. GitHub's host keys are pinned
in pezkuwi/github_host_keys, and the job's token drops to contents: read.

pezkuwi/host/phishing-publish.sh

@@ -136,7 +136,9 @@ for domain in protected:
 print(f"checked: {len(deny)} blocked sites, {sum(len(v) for v in address.values())} scam addresses")
 PY
 
-rsync -a --checksum --delete --delay-updates --chown=root:root --exclude index.html "$stage/" "$WEB_ROOT/"
+# Modes are set, not copied: the stage is a mktemp directory, 0700, and copying its mode made the
+# web root unreadable to nginx. Every list answered 403 until it was put back (2026-09-13).
+rsync -a --checksum --delete --delay-updates --chown=root:root --chmod=D755,F644 --exclude index.html "$stage/" "$WEB_ROOT/"
 printf '%s\n' "$new" >"$STATE_DIR/published.new"
 mv -f "$STATE_DIR/published.new" "$STATE_DIR/published"
 echo "published ${new:0:12}"

pezkuwi/host/test-publish.sh

@@ -75,6 +75,9 @@ check "all.json is master's" "$(sha256sum <"$LISTS/all.json")" "$(sha256sum <"$S
 check "a shard is master's" "$(sha256sum <"$LISTS/all/com/all.json")" "$(sha256sum <"$SB/www/all/com/all.json")"
 check "the stray all/all.json is gone" no "$([ -e "$SB/www/all/all.json" ] && echo yes || echo no)"
 check "index.html untouched" "$INDEX" "$(sha256sum "$SB/www/index.html")"
+# nginx reads as another user: a web root or list it cannot read answers 403.
+check "the web root and its directories are 755" 0 "$(find "$SB/www" -type d ! -perm 755 | wc -l)"
+check "the lists are 644" 0 "$(find "$SB/www" -type f ! -name index.html ! -perm 644 | wc -l)"
 check "the published commit is recorded" "$(git -C "$SB/work" rev-parse HEAD)" "$(cat "$SB/state/published")"
 check "nothing new: exit" 0 "$(publish)"
 check "nothing new: silent" "" "$(cat "$SB/out")"