Add a workstation deploy script

The Gitea runner is not up yet, so deploys need to be possible by hand.
scripts/deploy.sh mirrors the workflow: same hugo build, same rsync
invocation, same DEPLOY_PATH guards.

It previews every change and reports the number of server-side deletions
before asking to continue, since rsync runs with --delete. Credentials
live in the gitignored scripts/deploy.env.

Two Windows-specific guards, both hit in practice: it refuses an SSH key
under /mnt (WSL cannot hold 0600 there, so ssh rejects it) and it fails
with a clear message when run from Git Bash, which has no rsync.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

README.md

@@ -102,6 +102,28 @@ the VPS webroot.
 There is one deploy target. For development, run the site locally with
 `hugo server`.
 
+### Deploying from a workstation
+
+`scripts/deploy.sh` does the same thing without CI — useful while the Gitea
+runner is not set up. It needs `rsync`, so run it from WSL or another Linux
+shell, not Git Bash or PowerShell.
+
+```sh
+cp scripts/deploy.env.example scripts/deploy.env   # then fill it in (gitignored)
+./scripts/deploy.sh --dry-run                      # preview, upload nothing
+./scripts/deploy.sh                                # build, preview, confirm, deploy
+```
+
+| Flag | Effect |
+|---|---|
+| `--dry-run` | Stop after the preview |
+| `--yes` | Skip the confirmation prompt |
+| `--skip-build` | Deploy the existing `public/`, e.g. after building on Windows |
+
+The script previews every change and reports how many files would be **deleted**
+on the server before asking to continue. Keep the SSH key inside the WSL
+filesystem — a key under `/mnt/c` cannot hold `0600`, and ssh will reject it.
+
 ### Required secrets
 
 Set these in the Gitea repository settings: