feat(deploy): gitea sha-watch safety net - reload-only deploys [#734]

REST sensor polls master HEAD (scoped read token in host secrets);
sha change -> pull + reload_all, no core bounce. Webhook stays the
fast path pending gitea ALLOWED_HOST_LIST widening (CGNAT target).
Detail: https://projects.knownelement.com/issues/734

packages/deploy_pipeline.yaml

@@ -0,0 +1,19 @@
+# Deploy pipeline [#734]: gitea master-HEAD sha watcher. Feeds the
+# sha-watch deploy automation (reload-only apply). The gitea webhook
+# (gitea hook #10 -> pfv_deploy_git_webhook automation) is the fast path
+# with full restart mapping, but gitea cannot deliver webhooks to
+# CGNAT-range targets until its [webhook] ALLOWED_HOST_LIST is widened
+# (founder action via Cloudron file manager); this watcher is the
+# always-works safety net.
+rest:
+  - resource: https://git.knownelement.com/api/v1/repos/KNEL/pfv-bms/commits?limit=1
+    headers:
+      Authorization: Bearer !secret gitea_deploy_watch_token
+      User-Agent: pfv-bms-deploy-watch
+    scan_interval: 300
+    verify_ssl: true
+    sensor:
+      - name: PFV deploy gitea master head
+        unique_id: pfv_deploy_gitea_master_head
+        availability: "{{ value_json is defined and value_json | length > 0 }}"
+        value_template: "{{ value_json[0].sha }}"