ci: mount deploy key from /opt/runner/keys instead of /root/.ssh

Runner mel valid_volumes: [], takze mount /root/.ssh se tise zahazoval
a job container klic nikdy nedostal. Klic presunut do vyhrazeneho
adresare /opt/runner/keys, ktery je jako jediny povoleny v runner configu.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.forgejo/workflows/release.yml

@@ -11,7 +11,7 @@ jobs:
     container:
       image: golang:1.27
       volumes:
-        - /root/.ssh:/root/.ssh:ro
+        - /opt/runner/keys:/keys:ro
 
     steps:
       - name: Install packaging tools
@@ -21,9 +21,9 @@ jobs:
 
       - name: Setup SSH
         run: |
-          echo "HOME is: $HOME"
-          ls -la "$HOME/.ssh/" || true
-          echo "GIT_SSH_COMMAND=ssh -p 554 -i $HOME/.ssh/forgejo_runner -o StrictHostKeyChecking=no" >> "$GITHUB_ENV"
+          test -r /keys/forgejo_runner || { echo "Deploy key /keys/forgejo_runner chybi"; exit 1; }
+          install -m 600 /keys/forgejo_runner /tmp/forgejo_runner
+          echo "GIT_SSH_COMMAND=ssh -p 554 -i /tmp/forgejo_runner -o IdentitiesOnly=yes -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o LogLevel=ERROR" >> "$GITHUB_ENV"
 
       - name: Checkout source
         run: |
@@ -179,6 +179,10 @@ jobs:
           cp "dist/caddyview_${VER}_amd64.deb" apt-repo/
 
           cd apt-repo
+          # repo muze byt uplne prazdny (bez commitu a bez branche)
+          if ! git rev-parse --verify HEAD >/dev/null 2>&1; then
+            git checkout -b main
+          fi
           dpkg-scanpackages . > Packages
           gzip -k -f Packages
 
@@ -207,4 +211,4 @@ jobs:
           git config user.name "forgejo-actions[bot]"
           git add -A
           git commit -m "chore: add caddyview ${VERSION}"
-          git push
+          git push -u origin HEAD