ci(woodpecker): build-only pipeline (drop auto standalone deploy)

The deploy step did 'kubectl set image deployment/tidaldb' on every image
build, coupling image builds to a standalone roll. Deployment is manual via
kustomize from the orchard9-k3sf ops repo (its contract: no CI/CD deploy). The
one tidal-server binary serves both standalone and multi-process 'cluster
--region' modes, so this image covers the m8p10 3/3 cluster deploy too. Adds an
explicit 'm8p10' image tag for deterministic manifest pinning.

.woodpecker.yaml

@@ -1,3 +1,10 @@
+# Build-only pipeline: Kaniko builds the tidal-server image and pushes it to the
+# in-cluster zot registry. DEPLOYMENT IS MANUAL (kustomize, from the orchard9-k3sf
+# ops repo) — the old auto-`kubectl set image deployment/tidaldb` step was removed
+# because it coupled every image build to a standalone roll and the cluster ops
+# repo's contract is "manual deploy via scripts, no CI/CD deploy". The same
+# `tidal-server` binary serves every subcommand (standalone AND multi-process
+# `cluster --region`), so one image covers both deployments.
 when:
   branch: main
   event: push
@@ -11,23 +18,9 @@ steps:
       context: .
       tags:
         - latest
+        - m8p10
         - ${CI_COMMIT_SHA}
       registry: registry.threesix.ai
       build_args:
         - TARGETPLATFORM=linux/amd64
       extra_args: --customPlatform=linux/amd64
-
-  deploy:
-    image: bitnami/kubectl:latest
-    environment:
-      KUBE_CONFIG_DATA:
-        from_secret: kubeconfig
-      CI_COMMIT_SHA: $CI_COMMIT_SHA
-    commands:
-      - mkdir -p /tmp/.kube
-      - printenv KUBE_CONFIG_DATA | base64 -d > /tmp/.kube/config
-      - chmod 600 /tmp/.kube/config
-      - export KUBECONFIG=/tmp/.kube/config
-      - kubectl set image deployment/tidaldb tidaldb=registry.threesix.ai/tidal/server:${CI_COMMIT_SHA} -n tidaldb
-      - kubectl rollout status deployment/tidaldb -n tidaldb --timeout=180s
-    depends_on: [build]