ci: fall back to GCP_SA_KEY (Gitea doesn't inject OIDC request token)

Gitea Actions doesn't currently inject ACTIONS_ID_TOKEN_REQUEST_TOKEN /
ACTIONS_ID_TOKEN_REQUEST_URL into job env, so google-github-actions/auth
can't mint a federated token. The WIF infrastructure stays in Terraform
so we can flip back once that gap closes; the JSON key in GCP_SA_KEY is
the working path today.

.gitea/workflows/deploy.yaml

@@ -53,14 +53,18 @@ jobs:
           ls -la "$DEST" | head -5
           echo "EL_HOME=$DEST" >> "$GITHUB_ENV"
 
-      - name: Authenticate to GCP (Workload Identity)
+      - name: Authenticate to GCP
         id: auth
         uses: google-github-actions/auth@v2
         with:
-          workload_identity_provider: ${{ secrets.GCP_WIF_PROVIDER }}
-          service_account: ${{ secrets.GCP_DEPLOY_SA }}
-          # If WIF doesn't work against this Gitea instance, swap in:
-          # credentials_json: ${{ secrets.GCP_SA_KEY }}
+          # Gitea Actions doesn't currently inject ACTIONS_ID_TOKEN_REQUEST_TOKEN,
+          # so the WIF (workload_identity_provider + service_account) path fails
+          # at runtime — google-github-actions/auth needs that env var to mint
+          # a Gitea OIDC token. Fall back to the JSON SA key for now. The WIF
+          # provider + IAM bindings remain in Terraform so we can flip back
+          # once Gitea closes the gap (or once we wire act_runner into a
+          # custom OIDC issuer).
+          credentials_json: ${{ secrets.GCP_SA_KEY }}
 
       - name: Set up gcloud SDK
         uses: google-github-actions/setup-gcloud@v2