ci: migrate to thin ci-fleet-publish pipeline (oleks/ci-scripts#19)

Canary migration for the single/split quartet family. Rendered by
oleks/ci-scripts generator/render_thin_quartet.py from manifests/flake-hub.yaml
at oleks/ci-scripts@44d6ba9. Behavior-preserving per the diff posted on
oleks/ci-scripts#19: same env/secrets, same publish command, same
backend_options; image swaps to ci-fleet-publish:v1 and the explicit clone:
override is dropped (Woodpecker implicit clone is a verified superset for
this push-only, non-tag-history-dependent repo).

.woodpecker/amd64.yaml

@@ -1,6 +1,6 @@
 # GENERATED by oleks/ci-scripts — do not hand-edit.
-# Source manifest: manifests/flake-hub.yaml
-# Regenerate: python3 generator/render.py manifests/flake-hub.yaml --out <repo>/.woodpecker
+# Source: oleks/ci-scripts manifests/flake-hub.yaml + generator/render_thin_quartet.py (oleks/ci-scripts#17, #19).
+# Re-render with: python3 generator/render_thin_quartet.py --out <repo>/.woodpecker
 
 # Build flake-hub packages for x86_64-linux and push to attic.
 # Separate workflow per arch — sharing one PVC across arches makes
@@ -11,25 +11,24 @@ when:
   - event: push
     branch: main
 
-clone:
-  - name: clone
-    image: woodpeckerci/plugin-git
-    environment:
-      CI_NETRC_MACHINE: git.oleks.space
-      CI_NETRC_USERNAME: oleks
-      CI_NETRC_PASSWORD:
-        from_secret: gitea_clone_token
-      PLUGIN_TAGS: "false"
-      PLUGIN_DEPTH: "1"
-
 steps:
   - name: build-amd64
-    image: git.oleks.space/oleks/nix-ci:latest
+    image: git.oleks.space/oleks/ci-fleet-publish:v1
     environment:
       ATTIC_TOKEN:
         from_secret: attic_token
       GITEA_CLONE_TOKEN:
         from_secret: gitea_clone_token
+    settings:
+      run: |
+        sh ci/setup.sh
+        # Same front door as a local `nix run .#publish -- --publish`. The app
+        # is parity-lib's mkAtticClosurePublish (attic-closure archetype); CI and
+        # local share one audited impl. PUBLISH=1 makes it actually push (local
+        # runs dry-run).
+        PUBLISH=1 nix run .#publish
+      flow: publish
+      cache: "true"
     backend_options:
       kubernetes:
         nodeSelector:
@@ -38,11 +37,3 @@ steps:
           commit-tag: "${CI_COMMIT_TAG}"
           commit-branch: "${CI_COMMIT_BRANCH}"
           pipeline-number: "${CI_PIPELINE_NUMBER}"
-    commands:
-      - echo "▸ arch=$(uname -m)"
-      - sh ci/setup.sh
-      # Same front door as a local `nix run .#publish -- --publish`. The app
-      # is parity-lib's mkAtticClosurePublish (attic-closure archetype); CI and
-      # local share one audited impl. PUBLISH=1 makes it actually push (local
-      # runs dry-run).
-      - PUBLISH=1 nix run .#publish

.woodpecker/arm64.yaml

@@ -1,6 +1,6 @@
 # GENERATED by oleks/ci-scripts — do not hand-edit.
-# Source manifest: manifests/flake-hub.yaml
-# Regenerate: python3 generator/render.py manifests/flake-hub.yaml --out <repo>/.woodpecker
+# Source: oleks/ci-scripts manifests/flake-hub.yaml + generator/render_thin_quartet.py (oleks/ci-scripts#17, #19).
+# Re-render with: python3 generator/render_thin_quartet.py --out <repo>/.woodpecker
 
 # Build flake-hub packages for aarch64-linux and push to attic.
 # Separate workflow per arch — see amd64.yaml for rationale.
@@ -9,25 +9,24 @@ when:
   - event: push
     branch: main
 
-clone:
-  - name: clone
-    image: woodpeckerci/plugin-git
-    environment:
-      CI_NETRC_MACHINE: git.oleks.space
-      CI_NETRC_USERNAME: oleks
-      CI_NETRC_PASSWORD:
-        from_secret: gitea_clone_token
-      PLUGIN_TAGS: "false"
-      PLUGIN_DEPTH: "1"
-
 steps:
   - name: build-arm64
-    image: git.oleks.space/oleks/nix-ci:latest
+    image: git.oleks.space/oleks/ci-fleet-publish:v1
     environment:
       ATTIC_TOKEN:
         from_secret: attic_token
       GITEA_CLONE_TOKEN:
         from_secret: gitea_clone_token
+    settings:
+      run: |
+        sh ci/setup.sh
+        # NODE-BOUND LEG (emmett#44, cluster#192): aarch64-linux can't be built on
+        # emmett (linux/amd64) and these native packages have no cross path, so this
+        # leg must run on an aarch64 node (the arch nodeSelector above). Same
+        # parity-lib attic-closure front door as amd64, only the arch app differs.
+        PUBLISH=1 nix run .#publish-aarch64-linux
+      flow: publish
+      cache: "true"
     backend_options:
       kubernetes:
         nodeSelector:
@@ -36,11 +35,3 @@ steps:
           commit-tag: "${CI_COMMIT_TAG}"
           commit-branch: "${CI_COMMIT_BRANCH}"
           pipeline-number: "${CI_PIPELINE_NUMBER}"
-    commands:
-      - echo "▸ arch=$(uname -m)"
-      - sh ci/setup.sh
-      # NODE-BOUND LEG (emmett#44, cluster#192): aarch64-linux can't be built on
-      # emmett (linux/amd64) and these native packages have no cross path, so this
-      # leg must run on an aarch64 node (the arch nodeSelector above). Same
-      # parity-lib attic-closure front door as amd64, only the arch app differs.
-      - PUBLISH=1 nix run .#publish-aarch64-linux