ci(gitea): manual smoke + daily deploy-health; stamp the rsynced commit

deploy-health replaces the GitHub-Deployments-based drift check: it compares
the commit stamped on the server by the deploy action with each repo's main.
The deploy action now stamps the checked-out commit rather than GITHUB_SHA so
rollbacks are recorded truthfully.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AqpXh3hQMMaC74pTjFq4it

.gitea/actions/deploy/action.yml

@@ -80,10 +80,13 @@ runs:
           fi
         fi
 
+        # Stamp the commit that was actually rsynced (the checked-out tree), not
+        # GITHUB_SHA, so a rollback of an older commit is recorded truthfully.
+        DEPLOYED=$(git rev-parse HEAD 2>/dev/null || echo "$GITHUB_SHA")
         SLUG=$(printf '%s' "$TARGET_PATH" | tr '/' '_')
-        ssh -n $SSHOPT "$R" "mkdir -p ~/.peptide-deploys/$STAGE && printf '%s %s %s\n' '$GITHUB_SHA' '$GITHUB_REPOSITORY' \"\$(date -u +%FT%TZ)\" > ~/.peptide-deploys/$STAGE/$SLUG" \
+        ssh -n $SSHOPT "$R" "mkdir -p ~/.peptide-deploys/$STAGE && printf '%s %s %s\n' '$DEPLOYED' '$GITHUB_REPOSITORY' \"\$(date -u +%FT%TZ)\" > ~/.peptide-deploys/$STAGE/$SLUG" \
           || echo "::warning::could not record deployed commit for deploy-health"
-        echo "Deployed ${GITHUB_SHA:0:7} to $STAGE:$TARGET_PATH"
+        echo "Deployed ${DEPLOYED:0:7} to $STAGE:$TARGET_PATH"
 
     - name: Health check (${{ inputs.stage }})
       shell: bash