feat(deploy): branch model — box tracks release, dev is WIP-integration [#779 #344]

webhook ref-guard + sha-watch sensor pinned to ?sha=release;
sensor renamed pfv_deploy_gitea_release_head; master frozen.
https://projects.knownelement.com/issues/779

packages/deploy_pipeline.yaml

@@ -1,4 +1,4 @@
-# Deploy pipeline [#734]: gitea master-HEAD sha watcher. Feeds the
+# Deploy pipeline [#734]: gitea release-branch sha watcher. Feeds the
 # sha-watch deploy automation (reload-only apply). The gitea webhook
 # (gitea hook #10 -> pfv_deploy_git_webhook automation) is the fast path
 # with full restart mapping, but gitea cannot deliver webhooks to
@@ -6,15 +6,15 @@
 # (founder action via Cloudron file manager); this watcher is the
 # always-works safety net.
 rest:
-  - resource: https://git.knownelement.com/api/v1/repos/KNEL/pfv-bms/commits?limit=1
+  - resource: https://git.knownelement.com/api/v1/repos/KNEL/pfv-bms/commits?sha=release&limit=1
     headers:
       Authorization: !secret gitea_auth_header
       User-Agent: pfv-bms-deploy-watch
     scan_interval: 300
     verify_ssl: true
     sensor:
-      - name: PFV deploy gitea master head
-        unique_id: pfv_deploy_gitea_master_head
+      - name: PFV deploy gitea release head
+        unique_id: pfv_deploy_gitea_release_head
         value_template: "{{ value_json[0].sha if value_json is list and value_json | length > 0 else (value_json | string | truncate(90)) }}"
 
 # E2E self-deploy proof commit [#734] - if you can read this in /config,