ci: install only Rust in the check job, drop sudo

The check job failed inside mise: mise.toml pulls the full dev toolchain
(tailwind, cargo-watch, flyctl, shellcheck, mvdan/sh, ...) and resolves most of
it via api.github.com, which 401s on the runner (no github.com token) ->
"Failed to install tools" -> exit 1.

CI only needs Rust for fmt/clippy/test, so restrict mise to `install_args: rust`
(rust resolves through rustup, no GitHub API). Also drop `sudo` (the runner
image runs as root and has none) and the redundant `rustup component add`
(mise installs rustfmt/clippy from mise.toml). Keep mold — the .cargo linker
flag requires it.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.github/workflows/deploy.yml

@@ -26,8 +26,15 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Install mise
+      # The repo's mise.toml pulls the whole dev toolchain (tailwind, cargo-watch,
+      # flyctl, shellcheck, ...), and mise resolves most of those via the GitHub
+      # API — which 401s on this runner (it has no github.com token), failing the
+      # entire install. CI only needs the pinned Rust toolchain, so install it
+      # directly via mise (rust resolves through rustup, no GitHub API).
+      - name: Install Rust toolchain
         uses: https://github.com/jdx/mise-action@v2
+        with:
+          install_args: rust
 
       - name: Cache Cargo artifacts
         uses: actions/cache@v4
@@ -42,11 +49,10 @@ jobs:
             cargo-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }}-
             cargo-${{ runner.os }}-
 
+      # No sudo on the node:20-bookworm runner image (job runs as root). mold is
+      # required by .cargo/config.toml's linker flag (-fuse-ld=mold).
       - name: Install system dependencies
-        run: sudo apt-get update && sudo apt-get install -y clang lld mold libssl-dev pkg-config
+        run: apt-get update && apt-get install -y --no-install-recommends clang lld mold pkg-config
-
-      - name: Ensure Rust components
-        run: rustup component add rustfmt clippy
 
       - name: Check formatting
         run: cargo fmt -- --check