Deploy to Private Server via Tailscale OIDC

Zero-trust deployment: ephemeral OIDC credentials, restricted SSH keys, WireGuard tunnel.

Architecture

GITHUB RUNNER                    SERVER (100.120.175.47)
   │                                 │
   │ Tailscale OIDC (ephemeral)      │
   │ OpenSSH port 2222 (Tailscale)   │
   │ ed25519 key (restricted)        │
   │ command= limits commands        │
   └─────────────────────────────────┘
         │
   UFW: only tailscale0
   Internet: blocked