fix: unblock release-plz, add Phala deploy on release

[skgbafa]

Summary

Unblocks the release-plz pipeline that failed on the first post-changeset run, and adds automated Phala Cloud deployment on every published GitHub release.

Why release-plz failed

PR #49 enabled publish = true and switched the release tooling to release-plz + cargo-dist. On the first run, release-plz refused to proceed:

package tinycloud-node not found in the registry, but the git tag v1.3.0 exists. Consider running cargo publish manually to publish this package.

The v1.3.0 tag was created by the old changesets workflow, but the package was never published to crates.io. release-plz cannot reconcile a tag-without-registry-entry, so it errors.

Fix

• Deleted v1.3.0 from the remote (and local) so release-plz can publish v1.3.0 fresh on the next run. No code-level version bump — Cargo.toml stays at 1.3.0 so this becomes the first crates.io version.
• Added workflow_dispatch trigger to .github/workflows/release-plz.yml so the workflow can be re-triggered from the Actions UI without pushing a dummy commit.

Phala deployment

• New docker-compose.yml at the repo root for Phala Cloud. References the GHCR image by version, exposes 8000 (HTTP API), 8001 (Prometheus), 8081 (P2P relay), mounts a named volume at /app/data, and pulls TINYCLOUD_KEYS_SECRET from the CVM's encrypted secret store via env var (managed out-of-band in the Phala dashboard, never committed).
• New deploy-phala job in .github/workflows/docker.yml, gated on github.event_name == 'release' and needs: build. Rewrites the image tag in compose to match the released version (stripping the leading v to match metadata-action's {{version}} output), then runs phala deploy -c docker-compose.yml -n tinycloud-node --wait using PHALA_CLOUD_API_KEY from secrets.

The deploy targets the standard (non-dstack) image. If TEE-derived keys are wanted later, switch to the -dstack tag, set TINYCLOUD_KEYS_TYPE=Dstack, drop the keys secret env var, and mount /var/run/dstack.sock.

Pre-deploy validation

Compose was checked with the phala-compose-check skill: single-file, 950 bytes (well under 200 KB), no hardcoded secrets, named volume only, ports clean. CI builds the image on ubuntu-latest so amd64 is guaranteed.

Test plan

• After merge, manually trigger release-plz from Actions UI (workflow_dispatch).
• Verify release-plz opens a release PR; merging it should publish v1.3.0 to crates.io and create the v1.3.0 GitHub release.
• Verify the build job in docker.yml pushes ghcr.io/tinycloudlabs/tinycloud-node:1.3.0.
• Verify deploy-phala runs on the published release and phala deploy --wait reports a healthy CVM.
• Confirm TINYCLOUD_KEYS_SECRET is configured in the Phala CVM's encrypted secret store before the first deploy.