ci: keep Vercel token out of build logs
ci: clone without broken archival submodule
ci: deploy Werc site to Vercel from SourceHut