ci: staged deployment — push to main→staging, git tag→prod

- Push to main builds ARM64 image and deploys to docfast-staging namespace
- Push a version tag (v*) promotes latest image to docfast namespace (prod)
- Both use same deployer SA with namespace-scoped RBAC

.forgejo/workflows/deploy.yml

@@ -1,12 +1,12 @@
-name: Build & Deploy to K3s
+name: Build & Deploy to Staging
 
 on:
   push:
     branches: [ main ]
 
 jobs:
-  build-and-deploy:
-    name: Build & Deploy
+  build-and-stage:
+    name: Build & Deploy to Staging
     runs-on: ubuntu-latest
 
     steps:
@@ -36,7 +36,7 @@ jobs:
           git.cloonar.com/openclawd/docfast:${{ github.sha }}
         platforms: linux/arm64
 
-    - name: Deploy to K3s
+    - name: Deploy to Staging
       run: |
         curl -sLO "https://dl.k8s.io/release/$(curl -sL https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
         chmod +x kubectl
@@ -45,9 +45,9 @@ jobs:
 
         ./kubectl set image deployment/docfast \
           docfast=git.cloonar.com/openclawd/docfast:${{ github.sha }} \
-          -n docfast --kubeconfig=/tmp/kubeconfig.yaml
+          -n docfast-staging --kubeconfig=/tmp/kubeconfig.yaml
 
         ./kubectl rollout status deployment/docfast \
-          -n docfast --kubeconfig=/tmp/kubeconfig.yaml --timeout=180s
+          -n docfast-staging --kubeconfig=/tmp/kubeconfig.yaml --timeout=180s
 
-        echo "✅ Deploy complete!"
+        echo "✅ Staging deploy complete!"