Replace `task website-deploy` (which calls `hugo` directly and fails because Hugo is not installed on the CI runner) with the Dagger-based `task publish-website`, matching the pattern used by other jobs in deploy.yml. Also adds Dagger remote engine setup, runner tool checks, SSH_KNOWN_HOSTS secret, a timeout, and TLS credential cleanup. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>