Move the artifact pair to the exact commits @v3 was resolving to

Round 2 (602fd60) put the build job green:

    check / check                        success   6s
    Build and Deploy .../ build          success  20s   <- green
    Build and Deploy .../ deploy         skipped        <- if: guard
    probe / q1-upload-v3-node16          success   7s
    probe / q2-upload-v3-node20          success  22s
    probe / q3-build-for-roundtrip       success  11s
    probe / q4-deploy-dryrun             failure  43s

Every v3 upload works and the build job is fixed. But q4 -- the deploy-side
rehearsal, which downloads the artifact in the pinned node container and
installs the pinned wrangler, stopping short of the publish call -- failed.
That is a break the deploy job would have hit on main, in a job nobody has
ever been able to run.

q4 bundled two things together, so round 3 splits them:

- r1 runs only the wrangler install and invocation. Worth measuring rather
  than assuming: wrangler 4.120.0 declares engines.node >= 22 and the deploy
  container is node 20, though the pre-issue deploy did run an unpinned
  wrangler on node:20 successfully.
- r2a/r2b run the artifact round trip with no wrangler at all.
- r3a/r3b do the same for the newer node20 artifact builds, so the choice
  between the two pairs is made on measurement.

deploy.yml meanwhile moves to the artifact commits that the mutable `@v3`
references were actually resolving to while this site was deploying, rather
than to the newest thing on the v3 line:

- upload-artifact   -> ff15f030 (v3.2.1)
- download-artifact -> 9bc31d5c (v3.0.2)

That is the conservative reading of what this issue is for: pin what is known
to work, do not take a version bump for free on the way past.

.gitea/workflows/deploy.yml

@@ -59,11 +59,12 @@ jobs:
             # identical to this one but ending in upload-artifact v4 fails,
             # while the same job without that step passes. So this stays on
             # the v3 line, pinned, using the node20 build of it rather than
-            # the node16 default. Revisit when the artifact v4 protocol works
-            # here; tracked separately.
+            # here; tracked separately. This is the exact commit the mutable
+            # `@v3` used to resolve to, i.e. the code that was deploying this
+            # site before this issue -- now pinned instead of floating.
             - name: Upload artifact
-              # actions/upload-artifact v3.2.2-node20, 2026-08-09
-              uses: actions/upload-artifact@c6a3b2bd78b3985e4b2f15397fec357f0fd808de
+              # actions/upload-artifact v3.2.1, 2026-08-09
+              uses: actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5
               with:
                   name: site
                   path: site.tar.gz
@@ -83,9 +84,11 @@ jobs:
         steps:
             # Must match the upload-artifact major above -- v4 artifacts and
             # v3 artifacts are different protocols and do not interoperate.
+            # Like the upload above, this is the exact commit `@v3` used to
+            # resolve to.
             - name: Download artifact
-              # actions/download-artifact v3.1.0-node20, 2026-08-09
-              uses: actions/download-artifact@ad191675b41f6a5b46da9a048cb6893812da158b
+              # actions/download-artifact v3.0.2, 2026-08-09
+              uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a
               with:
                   name: site