Workflow and build-images.sh: compose deploy hint instead of /opt

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B

.gitea/workflows/build-images.yaml

@@ -4,7 +4,7 @@
 # Runner: act_runner with the label `host` on the owner's Raspberry Pi (Alpine-based host, docker builds on the
 # Pi itself). Pushes two linux/arm64 images to the Gitea container registry of the same instance (gitea.lan,
 # plain HTTP), each tagged with the version vMAJOR.MINOR.PATCH and `latest`, then pushes the git tag of that version.
-# On the Kvitt Pi: /opt/kvitt/deploy.sh <version>.
+# On the Kvitt Pi: cd ~/kvitt, set KVITT_TAG=<version> in .env, then docker compose pull && docker compose up -d.
 #
 # Secret: `kvitt_cicd`, a user-level secret of the repository owner (Gitea gives a repository its owner's secrets)
 # holding a Gitea access token with scope write:package of the user that pushes (owner step, infra/README.md). It is used only for `docker login`; the git tag push at the end goes through
@@ -117,7 +117,7 @@ jobs:
             ./server \
             --push
       - name: Print image digests
-        # The digests deploy.sh prints and records on the Kvitt Pi (/opt/kvitt/deployed-digests, D-117) must match.
+        # The digests the Kvitt Pi pulls (cd ~/kvitt && docker compose images, or docker image inspect) must match.
         run: |
           for name in backup server; do
             digest=$(sed -n 's/.*"containerimage.digest": *"\([^"]*\)".*/\1/p' "/tmp/kvitt-$name.metadata.json")

infra/build-images.sh

@@ -87,7 +87,7 @@ for spec in "${images[@]}"; do
 done
 
 if [[ $push == 1 ]]; then
-  echo "Pushed. On the Pi: /opt/kvitt/deploy.sh $tag"
+  echo "Pushed. On the Pi: cd ~/kvitt, set KVITT_TAG=$tag in .env, then docker compose pull && docker compose up -d"
 else
   echo
   echo "Built locally, not pushed: $reg_file does not exist. To push, create it (KVITT_REGISTRY=$registry, plus"