switch to Debian, the klakegg images are failing us

Specifically because the entrypoint of those images is hardcoded to
`hugo`, which makes CI fail with:

    Error: unknown command "sh" for "hugo"
    Run 'hugo --help' for usage.

.gitlab-ci.yml

 # use an older version of hugo, newer versions fail to build on first
 # run
 #
-# if this Docker image path kind of looks odd, it's because it is, and
-# that's because Hugo does not maintain official Docker images, but
-# they do recommend this one:
-#
-# https://gohugo.io/getting-started/installing/#docker
-image: registry.hub.docker.com/klakegg/hugo:0.54.0-debian
+# gohugo.io does not maintain docker images and the one they do
+# recommend fail in GitLab CI. we do not use the GitLab registry
+# either because we couldn't figure out the right syntax to get the
+# old version from Debian stretch (0.54)
+image: registry.hub.docker.com/library/debian:buster
 
 include:
   project: tpo/tpa/status-site
   file: .gitlab-ci.yml
 
+build:
+  before_script:
+    - apt update
+    - apt upgrade -yy
+    - apt install -yy hugo
+  stage: build
+  script:
+    - hugo
+  artifacts:
+    paths:
+      - public
+
+# we'd like to *not* rebuild hugo here, but pages fails with:
+#
+# jobs pages config should implement a script: or a trigger: keyword
+pages:
+  stage: deploy
+  before_script:
+    - apt update
+    - apt upgrade -yy
+    - apt install -yy hugo
+  script:
+    - hugo
+  artifacts:
+    paths:
+      - public
+  only:
+    - merge_requests
+
 variables:
   GIT_SUBMODULE_STRATEGY: recursive
   SITE_URL: research.torproject.org