ci: stop ops/** from triggering the ISO build; hand site trees back to the VM user after CI deploy

The runner job runs as root, which left /srv/furtka-site and
/var/www/furtka.org root-owned and broke the manual deploy.sh path.
Runner capacity on forge-runner-01 raised to 2 alongside this, so the
site deploy no longer queues behind an ISO build.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MScAinbyMdeNc7H2BZdnnG

.forgejo/workflows/build-iso.yml

@@ -12,6 +12,7 @@ on:
       - '**/*.md'
       - 'docs/**'
       - 'website/**'
+      - 'ops/**'
       - 'CHANGELOG.md'
       - 'RELEASING.md'
   workflow_dispatch:

website/deploy-ci.sh

@@ -24,4 +24,10 @@ echo "==> hugo build → $WEBROOT"
 cd "$SRCROOT"
 hugo --minify --cleanDestinationDir -d "$WEBROOT"
 
+# The runner job runs as root inside the container; hand the trees back
+# to the VM user so the manual deploy.sh path keeps working afterwards.
+if [ "$(id -u)" = 0 ]; then
+  chown -R "${FURTKA_OWNER:-1000:1000}" "$SRCROOT" "$WEBROOT"
+fi
+
 echo "OK: deployed to https://furtka.org/"