Add temporary diagnostic step for aquaria connectivity

ssh-keyscan's -v only traces SSH-protocol activity; a pre-handshake
failure (bad DNS, TCP connect hang/drop) prints nothing regardless.
Firewall allow-listing is ruled out (same external IP as a working
manual connection), so check DNS resolution and a raw nc TCP connect
from inside the runner container directly. Remove once root-caused.

.gitea/workflows/build-deploy.yml

@@ -13,13 +13,28 @@ jobs:
       - name: Install system dependencies
         run: |
           apt-get update
-          apt-get install -y --no-install-recommends git rsync openssh-client nodejs
+          apt-get install -y --no-install-recommends git rsync openssh-client nodejs netcat-openbsd dnsutils
 
       - name: Checkout
         uses: actions/checkout@v4
         with:
           submodules: false
 
+      # Temporary diagnostic step — remove once the aquaria connectivity
+      # issue is root-caused. ssh-keyscan swallows pre-handshake failures
+      # even with -v, so this checks DNS + raw TCP connect independently.
+      - name: Diagnose connectivity to deploy host
+        env:
+          DEPLOY_HOST: ${{ vars.DEPLOY_HOST }}
+          DEPLOY_PORT: ${{ vars.DEPLOY_PORT }}
+        run: |
+          echo "--- DNS resolution ---"
+          getent hosts "$DEPLOY_HOST" || echo "getent: no result"
+          dig +short A "$DEPLOY_HOST" || true
+          dig +short AAAA "$DEPLOY_HOST" || true
+          echo "--- TCP connect (IPv4) ---"
+          nc -4 -zv -w 8 "$DEPLOY_HOST" "${DEPLOY_PORT:-22}" || echo "nc exit code: $?"
+
       - name: Set up SSH key
         # Same key used both as the theme repo's deploy key (Gitea) and for
         # the webserver login (below) — one secret, two authorized_keys entries.