Own the redoal-portal instance: deploy pinned portal releases from here

Same instance-ownership move as uhhm/questions: pin PORTAL_RELEASE,
ship /srv/app/redoal-portal from the published artifact, write env from
this repo's own Actions config, own the redoal.com Caddy route. Lint
now uses this instance's question_lint, matching the pinned version.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.gitea/workflows/lint-and-reload.yml

@@ -15,13 +15,13 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      # Same bare-metal runner/host as portal's own deploy job, which
-      # publishes this binary to a stable path on every deploy - runs
-      # portal's real transition-table/shape validation directly, not a
-      # hand-maintained yq/jq subset of the same rules (lint.sh, now
-      # superseded and removed).
+      # Same bare-metal runner/host as this repo's own Deploy workflow,
+      # which ships question_lint alongside the portal binary in every
+      # pinned release - so content is validated by the exact portal
+      # version this instance runs, not a hand-maintained yq/jq subset
+      # of the same rules.
       - name: Lint questions
-        run: /srv/app/uhhm-portal/current/question_lint --path questions
+        run: /srv/app/redoal-portal/current/question_lint --path questions
 
   reload:
     runs-on: bare