The publish job used `npx surfer put --token` - the unscoped package, which
resolves to 0.0.2, and the v6 token flow, which Surfer no longer accepts. Move
to @cloudron/surfer 7.2.0, pinned: username allan plus the per-app password in
the SURFER_PASSWORD secret, app datacontroller.io.
`deploy` rather than `put`: it tars the build, extracts to a staging folder and
swaps it in, so a failed upload leaves the current site serving, and it records
the build's ref and commit in the site history. Also adds workflow_dispatch, so
a deploy can be run by hand without pushing to main.
dc