CI: join vu-smoke to the reground network, not the default bridge

The job's own sandbox container is created on the "reground" network, but
a plain docker run (no --network) puts vu-smoke on the default bridge
instead — two different, unrouted networks, so the curl in the previous
fix couldn't reach it at all and just hung for 2 minutes until it timed
out, rather than failing fast.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.gitea/workflows/deploy.yml

@@ -30,14 +30,18 @@ jobs:
         #
         # The runner shares the host's Docker daemon, so a hardcoded host
         # port (this used to be -p 8080:80) is contended across every repo's
-        # CI on the same host, not scoped to this job — hence the previous
+        # CI on the same host, not scoped to this job — hence the earlier
         # "port already allocated" failures even after cleaning up any
-        # leftover vu-smoke container. Curl the container's own bridge IP
-        # instead, so no host port is published at all.
+        # leftover vu-smoke container. Curl the container's own IP instead,
+        # so no host port is published at all — but this job's own sandbox
+        # container lives on the "reground" network, not the default bridge,
+        # so vu-smoke has to join that same network or the two can't reach
+        # each other at all (that's why the first attempt at this just hung
+        # for 2 minutes before timing out, rather than failing fast).
         run: |
           docker rm -f vu-smoke 2>/dev/null || true
           docker build -t vu:ci .
-          docker run -d --name vu-smoke vu:ci
+          docker run -d --name vu-smoke --network reground vu:ci
           sleep 1
           container_ip=$(docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' vu-smoke)
           curl -sf "http://${container_ip}/" | grep -q 'vu — Divine Office'