feat(deploy): gitea sha-watch safety net - reload-only deploys [#734]

REST sensor polls master HEAD (scoped read token in host secrets);
sha change -> pull + reload_all, no core bounce. Webhook stays the
fast path pending gitea ALLOWED_HOST_LIST widening (CGNAT target).
Detail: https://projects.knownelement.com/issues/734

.crush/active-ticket

@@ -0,0 +1 @@
+#734

automations.yaml

@@ -256,7 +256,7 @@
            + (trigger.json.commits | default([]) | map(attribute='removed') | flatten | list)
            + (trigger.json.commits | default([]) | map(attribute='modified') | flatten | list) }}
       need_restart: >-
-        {{ changed_files | select('in', ['configuration.yaml', 'packages/plant_snmp.yaml']) | list | count > 0 }}
+        {{ changed_files | select('match', '^(configuration\.yaml|packages/.+)') | list | count > 0 }}
       push_message: >-
         Git push ({{ trigger.json.sender.login | default('unknown') }}):
         {{ trigger.json.commits | default([]) | map(attribute='message') | join(' | ') | truncate(120) }}.
@@ -315,3 +315,49 @@
       data:
         title: PFV deploy complete
         message: "Pulled + reloaded YAML at {{ now().strftime('%H:%M:%S') }} - no core restart. Files: {{ changed_files | join(', ') | truncate(120) }}"
+# Deploy pipeline safety net [#734]: polls gitea master HEAD (rest sensor
+# in packages/deploy_pipeline.yaml) and applies pulls reload-only. The
+# gitea webhook is the fast path once gitea's SSRF allowlist permits
+# pfv-bms.knel.net; until then this net catches every push within 5 min
+# with NO core restart. Restarts for new platform sensors stay manual
+# (22222 shell) until the webhook path is live.
+- id: pfv_deploy_sha_watch
+  alias: PFV deploy - gitea sha watch safety net
+  description: >-
+    Master HEAD sha changed -> pull + reload_all, no core restart.
+    Interim deploy trigger while gitea webhook delivery is blocked by
+    its SSRF host allowlist [#734].
+  mode: single
+  max_exceeded: silent
+  triggers:
+  - trigger: state
+    entity_id: sensor.pfv_deploy_gitea_master_head
+    not:
+    - unknown
+    - unavailable
+  conditions:
+  - condition: template
+    value_template: >-
+      {{ trigger.from_state is not none
+         and trigger.from_state.state not in ['unknown', 'unavailable']
+         and trigger.to_state is not none
+         and trigger.from_state.state != trigger.to_state.state }}
+  actions:
+  - action: hassio.addon_restart
+    data:
+      addon: core_git_pull
+  - delay:
+      hours: 0
+      minutes: 0
+      seconds: 20
+  - action: homeassistant.reload_all
+  - action: notify.send_message
+    target:
+      entity_id:
+      - notify.ultix_sidecar_new
+      - notify.allthes_ipad
+    data:
+      title: PFV deploy (sha watch)
+      message: >-
+        New master HEAD pulled + reloaded at {{ now().strftime('%H:%M:%S') }}
+        - no core restart. HEAD {{ states('sensor.pfv_deploy_gitea_master_head')[:7] }}

packages/deploy_pipeline.yaml

@@ -0,0 +1,19 @@
+# Deploy pipeline [#734]: gitea master-HEAD sha watcher. Feeds the
+# sha-watch deploy automation (reload-only apply). The gitea webhook
+# (gitea hook #10 -> pfv_deploy_git_webhook automation) is the fast path
+# with full restart mapping, but gitea cannot deliver webhooks to
+# CGNAT-range targets until its [webhook] ALLOWED_HOST_LIST is widened
+# (founder action via Cloudron file manager); this watcher is the
+# always-works safety net.
+rest:
+  - resource: https://git.knownelement.com/api/v1/repos/KNEL/pfv-bms/commits?limit=1
+    headers:
+      Authorization: Bearer !secret gitea_deploy_watch_token
+      User-Agent: pfv-bms-deploy-watch
+    scan_interval: 300
+    verify_ssl: true
+    sensor:
+      - name: PFV deploy gitea master head
+        unique_id: pfv_deploy_gitea_master_head
+        availability: "{{ value_json is defined and value_json | length > 0 }}"
+        value_template: "{{ value_json[0].sha }}"