Deploy from GitHub with a systemd timer instead of Gitea Actions

Cosmos keeps a deploy-only clone of the GitHub repo. gk-deploy.timer runs
pull-and-deploy.sh every 5 minutes: it fetches master and, when it has
moved, runs deploy.sh (build, check, restart, roll back if unhealthy). A
commit that failed is not retried until master moves (FORCE=1 retries), and
DEPLOY_HEALTHCHECK_URL turns red on a failed fetch or deploy. Removes the
Gitea workflow and updates the runbook, README and inventory note.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012aSbo2D1qP8cMFQCykf7kx

deploy/pull-and-deploy.sh

@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+# Run by gk-deploy.timer on Cosmos: fetches master from GitHub into the
+# deploy-only clone and, when it has moved, runs deploy.sh on it. A commit that
+# failed to deploy is not retried until master moves again (or FORCE=1).
+# Pings DEPLOY_HEALTHCHECK_URL from the stack's .env when set. See docs/deploy.md.
+set -uo pipefail
+
+STACK="${GK_STACK_DIR:-/home/greg/homelab/gregkilmer}"
+export GK_STACK_DIR="$STACK"
+cd "$(dirname "$0")/.."
+
+hc="$(grep -E '^DEPLOY_HEALTHCHECK_URL=' "$STACK/.env" 2>/dev/null | cut -d= -f2- || true)"
+ping() { [ -n "$hc" ] && curl -fsS -m 10 --retry 3 "$hc$1" >/dev/null 2>&1 || true; }
+
+if ! git fetch --quiet origin master; then
+  echo "Could not fetch from GitHub"
+  ping /fail
+  exit 1
+fi
+target="$(git rev-parse --short=12 origin/master)"
+running="$(grep -E '^GK_TAG=' "$STACK/.env" 2>/dev/null | cut -d= -f2- || true)"
+failed="$(cat "$STACK/.failed-tag" 2>/dev/null || true)"
+
+if [ "$target" = "$running" ] && [ "${FORCE:-}" != "1" ]; then
+  ping ""
+  exit 0
+fi
+if [ "$target" = "$failed" ] && [ "${FORCE:-}" != "1" ]; then
+  echo "$target failed to deploy before; waiting for a new commit (FORCE=1 to retry)"
+  ping /fail
+  exit 0
+fi
+
+# The clone is for deploys only, so it always matches master exactly.
+git reset --quiet --hard origin/master
+git clean -fdq
+
+ping /start
+if ./deploy/deploy.sh; then
+  rm -f "$STACK/.failed-tag"
+  ping ""
+else
+  echo "$target" > "$STACK/.failed-tag"
+  ping /fail
+  exit 1
+fi