fix(deploy): sha-watch deploys must restart core - reload kills webhook triggers [#345]

Found live 2026-09-03: after reload-only deploys, webhook-triggered
automations (doorman ingest, deploy fast path) silently stop firing
while the endpoint still returns HTTP 200. Proven: core restart
restores them. Sha-watch now restarts core on every new master HEAD
(same semantics as the webhook fast path for packages/** changes).

https://projects.knownelement.com/issues/345

automations.yaml

@@ -330,9 +330,15 @@
 - id: pfv_deploy_sha_watch
   alias: PFV deploy - gitea sha watch safety net
   description: >-
-    Master HEAD sha changed -> pull + reload_all, no core restart.
+    Master HEAD sha changed -> pull + CORE RESTART. Interim deploy
-    Interim deploy trigger while gitea webhook delivery is blocked by
+    trigger while gitea webhook delivery is blocked by its SSRF host
-    its SSRF host allowlist [#734].
+    allowlist [#734]. Restart (not reload) is REQUIRED: automation
+    reload loses webhook-trigger registration - found live 2026-09-03
+    (#345): after any reload-only deploy, webhook automations (doorman
+    scan ingest, this pipeline's own fast path) silently stop firing
+    while the endpoint still returns HTTP 200. Core restart
+    re-registers them. Accepted trade-off: ~1 min HA outage per
+    master deploy.
   mode: single
   max_exceeded: silent
   triggers:
@@ -353,7 +359,6 @@
       hours: 0
       minutes: 0
       seconds: 20
-  - action: homeassistant.reload_all
   - action: notify.send_message
     target:
       entity_id:
@@ -362,5 +367,7 @@
     data:
       title: PFV deploy (sha watch)
       message: >-
-        New master HEAD pulled + reloaded at {{ now().strftime('%H:%M:%S') }}
+        New master HEAD {{ states('sensor.pfv_deploy_gitea_master_head')[:7] }}
-        - no core restart. HEAD {{ states('sensor.pfv_deploy_gitea_master_head')[:7] }}
+        pulled. Restarting HA core (webhook re-registration) - back in
+        ~1 min.
+  - action: homeassistant.restart