Move runner to oci, simplify deploy script

- Runner now runs on oci (arm64) — docker/kubectl are local, no SSH needed
- deploy-preview.py rewritten with subprocess (no os.system, no SSH)
  - deploy: build image, copy prod DB, create namespace, apply manifests
  - teardown: delete namespace + image
  - deploy-prod: build, push, rollout restart
- Simplified all workflow files to just call the Python script
- Deleted old hera-runner

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.gitea/workflows/deploy.yml

@@ -12,12 +12,5 @@ jobs:
       - name: Unit tests
         run: cd frontend && npm ci && npm run test:unit
 
-      - name: Build & Deploy
-        run: |
-          rsync -az --exclude node_modules --exclude .git --exclude .venv . oci:~/oil-calculator/
-          ssh oci "
-            cd ~/oil-calculator &&
-            docker build -t registry.oci.euphon.net/oil-calculator:latest . &&
-            docker push registry.oci.euphon.net/oil-calculator:latest &&
-            sudo k3s kubectl rollout restart deploy/oil-calculator -n oil-calculator
-          "
+      - name: Deploy
+        run: python3 scripts/deploy-preview.py deploy-prod