Add the manual CD release workflow

One dispatch builds and pushes both images and builds the desktop packages
into a Gitea release (desktop-v<version>, installers + latest*.yml attached,
idempotent on re-run). The live update feed stays a deploy-host operation:
CI has no SSH key for jakerasp, so push_desktop.sh --no-build remains the
way to publish it.

Repo secrets REGISTRY_USER/REGISTRY_TOKEN are set, so the image push uses
the Gitea registry credentials directly.

deploy/README.md

@@ -164,6 +164,16 @@ does not. The desktop app's "Check for updates…" menu item reads
 `latest-linux.yml` / `latest.yml` from there (see `desktop/README.md`).
 Backend-only composes have no frontend, so no feed.
 
+The manual **CD** workflow (Actions tab) builds the desktop packages on the
+runner and attaches them plus the update metadata to the Gitea release
+`desktop-v<version>`; it does not touch the live feed, because that is
+runtime state on the deploy host and CI has no SSH key for it. After a CD run,
+publish the feed from a machine that can reach the deploy checkout:
+
+```bash
+./push_desktop.sh --no-build --local   # or without --local to also copy it
+```
+
 ## Scheduled jobs
 
 Compose files with a backend also run a **`scheduler`** service — the same