ops: add CI boot-image releases and Unifi PXE rollout

docs/RUNNER_IMAGES.md

@@ -50,6 +50,36 @@ Build an aarch64 SD image:
 nix build .#nixosConfigurations.ec-runner-aarch64-sdimage.config.system.build.sdImage
 ```
 
+## CI Deploy (Forgejo Releases)
+
+Boot images can be built and published from CI via:
+
+- `.forgejo/workflows/deploy-runner-images.yml`
+
+Triggers:
+
+- Manual: `workflow_dispatch`
+- Tags: `boot-v*` (for example `boot-v2026.02.28`)
+
+Manual inputs (all optional):
+
+- `release_tag` (defaults to `boot-<short-sha>`)
+- `publish_release` (`true`/`false`, default `true`)
+- `build_x86_64_netboot` (`true`/`false`, default `true`)
+- `build_x86_64_iso` (`true`/`false`, default `true`)
+
+Published assets are attached to the resolved Forgejo release tag and include:
+
+- x86_64 netboot bundle (`kernel`, `initrd`, `netboot.ipxe`) as `.tar.gz`
+- x86_64 installer `.iso`
+- `SHA256SUMS.txt`
+
+Notes:
+
+- CI image publish is disabled on the Codeberg mirror host.
+- Current CI scope is x86_64 targets; aarch64 image builds remain local/manual unless an aarch64-capable runner is added.
+- For multi-NUC PXE rollout on Unifi networks, use `docs/NUC_UNIFI_NETBOOT.md`.
+
 ## Outputs
 
 After building, artifacts will be in `./result` (a symlink into the Nix store).