publish: replace workflow_call stub with self-contained workflow

workflow_call cross-repo fetch fails auth on this Gitea setup —
the auto-generated run token is scoped to ncmr-songs only and
cannot clone the private novoyuuparosk-auto-wiki repo during
workflow preparation. Flattened into a standalone job that
clones auto-wiki in a step using FAPAT, which works.

Also switches server URL references to vars.GITEA_URL to avoid
relying on github.server_url which resolves to github.com here.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.gitea/workflows/publish.yml

@@ -9,8 +9,64 @@ on:
 
 jobs:
   publish:
-    uses: mikkeli/novoyuuparosk-auto-wiki/.gitea/workflows/publish-songs.yml@automation/songs
+    runs-on: ubuntu-latest
-    with:
+    container:
+      image: python:3.12-slim
+
+    steps:
+      - name: Install system deps
+        run: apt-get update -qq && apt-get install -y --no-install-recommends git pandoc ca-certificates
+
+      - name: Checkout ncmr-songs
+        env:
+          FAPAT: ${{ secrets.FAPAT }}
+          GITEA_URL: ${{ vars.GITEA_URL }}
+        run: |
+          git clone "http://mikkeli:${FAPAT}@${GITEA_URL#http://}/mikkeli/ncmr-songs" ncmr-songs
+          git -C ncmr-songs checkout ${{ github.sha }}
+
+      - name: Checkout auto-wiki (renderer)
+        env:
+          FAPAT: ${{ secrets.FAPAT }}
+          GITEA_URL: ${{ vars.GITEA_URL }}
+        run: git clone "http://mikkeli:${FAPAT}@${GITEA_URL#http://}/mikkeli/novoyuuparosk-auto-wiki" auto-wiki
+
+      - name: Install Python deps
+        run: pip install --no-cache-dir -r auto-wiki/pipelines/songs/requirements.txt
+
+      - name: Detect changed files
+        id: diff
+        run: |
+          BASE="${{ github.event.before }}"
+          HEAD="${{ github.sha }}"
+          if [ -z "$BASE" ] || echo "$BASE" | grep -qE '^0+$'; then
+            echo "mode=all" >> "$GITHUB_OUTPUT"
+          else
+            git -C ncmr-songs diff --name-only "$BASE" "$HEAD" -- '*.md' \
+              | grep -v '^wip/' | grep -v '^README\.md' \
+              > /tmp/changed.txt 2>/dev/null || true
+            cat /tmp/changed.txt
+            echo "mode=incremental" >> "$GITHUB_OUTPUT"
+            echo "files=$(tr '\n' ' ' < /tmp/changed.txt)" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Publish
+        env:
+          WIKI_API_URL: ${{ vars.WIKI_API_URL }}
+          WIKI_BASE_URL: ${{ vars.WIKI_BASE_URL }}
+          WIKI_BOT_USER: ${{ secrets.WIKI_BOT_USER }}
+          WIKI_BOT_PASSWORD: ${{ secrets.WIKI_BOT_PASSWORD }}
           SOURCE_REF: ${{ github.sha }}
-      SOURCE_BASE_REF: ${{ github.event.before }}
+          GITEA_REPO_URL: ${{ vars.GITEA_URL }}/mikkeli/ncmr-songs
-    secrets: inherit
+        run: |
+          if [ "${{ steps.diff.outputs.mode }}" = "all" ]; then
+            python auto-wiki/pipelines/songs/render.py --source-dir ncmr-songs --all
+          else
+            FILES="${{ steps.diff.outputs.files }}"
+            if [ -z "$FILES" ]; then
+              echo "No changed .md files. Nothing to publish."
+              exit 0
+            fi
+            # shellcheck disable=SC2086
+            python auto-wiki/pipelines/songs/render.py --source-dir ncmr-songs --files $FILES
+          fi