fix: use heredoc for python3 to avoid shell quoting bugs

The previous python3 -c '...' approach broke when lambdas
contained single quotes (e.g. '"' + tag + '"'), causing
the bash string to terminate early and output literal text
instead of variable values.

.gitea/actions/flux-deploy/action.yml

@@ -75,13 +75,14 @@ runs:
         cd "$workdir/gitops"
 
         # ── Update image fields via regex ──────────────────────────
-        python3 -c '
+        python3 << 'PYEOF'
         import os, pathlib, re
 
         path      = pathlib.Path(os.environ["GITOPS_FILE"])
         repo      = os.environ.get("IMAGE_REPOSITORY", "")
         tag       = os.environ["IMAGE_TAG"]
         tag_keys  = [k.strip() for k in os.environ["TAG_KEYS"].split(",") if k.strip()]
+        Q = '"'
 
         text = path.read_text()
 
@@ -94,14 +95,12 @@ runs:
             # Pattern matches both formats:
             #   tag: 2026-06-17-abc1234           (unquoted)
             #   tag: "2026-06-17-abc1234"         (quoted)
-            #   rustImageTag: &anchor "value"     (YAML anchor with quotes)
+            #   imageTag: &anchor "value"         (YAML anchor with quotes)
             #   tag: *anchor                      (YAML alias — left alone by design)
-            #
-            # Group 1: everything up to and including the last quote or whitespace before the value
-            # Replacement: group(1) + new tag (preserving quoting style)
+            pat_quoted = r"(" + re.escape(key) + r':\s*(?:&\S+\s+)?)"[^"]*"'
             quoted = re.sub(
-                r"(" + re.escape(key) + r""":\s*(?:&\S+\s+)?)\"[^"]*\"""",
-                lambda m: m.group(1) + '"' + tag + '"',
+                pat_quoted,
+                lambda m: m.group(1) + Q + tag + Q,
                 text
             )
             if quoted != text:
@@ -116,7 +115,7 @@ runs:
                 )
 
         path.write_text(text)
-        '
+        PYEOF
 
         # ── Commit + push (idempotent) ────────────────────────────
         if git diff --quiet -- "$GITOPS_FILE"; then