ci: align workflows with pipeline-actions composite actions

- haven-notify.yaml: replace hand-rolled build+deploy (broken
  docker/build-push-action remote-builder path) with pipeline-actions
  build-and-push + deploy-restart; full Gitea uses: URLs; ubuntu-amd64.
- main.yaml / test-automated-nfs-backup.yaml: runner label
  ubuntu-latest -> ubuntu-amd64.
- haven-notify/README.md: point to infra/haven-notify.yaml in the
  haven repo; fix secret name to discord-webhook/HAVEN_WEBHOOK_URL.

haven-notify/README.md

@@ -86,11 +86,11 @@ It's built in Go and can be deployed as a container or managed service.
 	```
 
 ### Kubernetes
-Deployment manifest is available at `deploy/haven-notify.yaml`.
+The Deployment/Service/Ingress manifest lives in the **`haven`** homelab repo at `infra/haven-notify.yaml` (this repo only holds the Go source + Dockerfile + CI).
 1. Edit the manifest to set your environment variables.
-2. Create a generic secret named `WEBHOOK_URL` with `discord-webhook=your_webhook_url`:
-  - `kubectl create secret generic WEBHOOK_URL --from-literal=discord-webhook=<your_webhook_url> -n <namespace>`
-3. Apply deployment:
+2. Create a generic secret named `discord-webhook` with `HAVEN_WEBHOOK_URL=your_webhook_url`:
+  - `kubectl create secret generic discord-webhook --from-literal=HAVEN_WEBHOOK_URL=<your_webhook_url> -n <namespace>`
+3. Apply deployment (from the `haven` repo):
 	```sh
-	kubectl apply -f deploy/haven-notify.yaml
+	kubectl apply -f infra/haven-notify.yaml
 	```