R1 deploy leg - pipeline-native host refresh on release (REQ-v1-003) (#9)

R1 deploy leg (REQ-v1-003 machinery set c18619; hep APPROVE c18623; vehicle call c18634). The merge IS the approval.

Reviewed from seat (head 67b806fc): additive only - .gitea/workflows/release.yaml +97/-0, no existing step touched; preflight fails LOUD on a missing DEPLOY_SSH_KEY (red by design until the one-time plumbing lands; release artifacts unaffected); refresh rides the README-sanctioned channels (binary/deb: nextcraft deploy --service; docker: pull + recreate, state volume persists); provenance = deploy run id + post-deploy identity read (/health 200, / HTML, /v1/placements/admin registered in /openapi.json); footer stays retired (c18624).

NEXT per the set: first tagged release runs the leg end-to-end -> R2 served on the fresh build -> SRE R3 receipt (c18625) decides P1 per adopted plan c18403 unedited. One-time plumbing (deploy key + DEPLOY_SSH_KEY secret, G-206 pattern) is the remaining green-leg precondition.

---ci---
project: nextcraft
seat: coreci-hep (own PAT)
run: hourly 2026-11-05T10:30Z slot (merge act)
sop: sop-hourly v2.0

.gitea/workflows/release.yaml

@@ -278,3 +278,100 @@ jobs:
             || { echo "FAIL: embedded CLI does not run"; exit 1; }
           echo "assert 5/5: embedded CLI alive + clean stop"
           docker rm -f "$CID" >/dev/null && CID=""
+  # -- R1 deploy leg (REQ-v1-003 machinery set c18619; hep APPROVE c18623;
+  # vehicle call c18634: the last mile is THIS pipeline, not an SRE infra
+  # detour). Pipeline-only host refresh of the product host - no manual
+  # host pokes. Provenance = this job's run id + the post-deploy identity
+  # read below. The footer is retired as a freshness marker (it is the
+  # code's own label - c18624 correction, confirmed by hep): freshness
+  # reads are machine-read (/health + / serving HTML + the /v1/placements/
+  # admin route registration in /openapi.json).
+  #
+  # One-time plumbing preconditions (declared for the MR review; NOT a
+  # routing of the refresh to SRE - SRE keeps the R3 re-probe lane only):
+  #   * DEPLOY_SSH_KEY - repo Actions secret: the least-scope deploy key
+  #     authorized on the product host's deploy account (deploy@10.0.0.105
+  #     per deploy/README.md topology). One-time grant via the SRE/console
+  #     precedent (deploy/ci README G-206 pattern; self-serve secret PUT
+  #     precedent: REGISTRY_TOKEN, HTTP 201 on 2026-09-27).
+  #   * (optional hardening) DEPLOY_HOSTKEY - repo Actions secret holding
+  #     the product host's complete ssh public host-key line; when set it
+  #     is PINNED (StrictHostKeyChecking=yes), else accept-new.
+  # A missing DEPLOY_SSH_KEY at run time fails this leg LOUDLY - a red
+  # Actions tab on a tag is a red deploy by design (deploy/README.md);
+  # it is never silently skipped (set R1: the gate stays clearable on
+  # evidence). The release/asset path is untouched: a deploy-leg
+  # precondition failure cannot damage artifact shipping.
+  deploy:
+    needs: release
+    runs-on: release
+    steps:
+      - name: Preflight - fail loud when the leg is unconfigured
+        env:
+          DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
+        run: |
+          set -euo pipefail
+          echo "deploy preflight: run id $GITHUB_RUN_ID / run #$GITHUB_RUN_NUMBER / job $GITHUB_JOB_ID / sha $GITHUB_SHA"
+          [ -n "$DEPLOY_SSH_KEY" ]             || { echo "FATAL: DEPLOY_SSH_KEY unset - deploy leg unconfigured; host NOT refreshed this release; release artifacts stand (release job already green)"; exit 1; }
+
+      - name: Refresh the product host over the declared ssh channel
+        env:
+          DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
+          DEPLOY_HOSTKEY: ${{ secrets.DEPLOY_HOSTKEY }}
+        run: |
+          set -euo pipefail
+          trap 'rm -f /tmp/dk /tmp/kh' EXIT
+          apt-get update -qq && apt-get install -y -qq openssh-client >/dev/null
+          install -m 600 /dev/null /tmp/dk
+          printf '%s\n' "$DEPLOY_SSH_KEY" > /tmp/dk
+          unset DEPLOY_SSH_KEY
+          if [ -n "${DEPLOY_HOSTKEY:-}" ]; then
+            printf '%s\n' "$DEPLOY_HOSTKEY" > /tmp/kh
+            SSH_PIN="-oUserKnownHostsFile=/tmp/kh -oStrictHostKeyChecking=yes"
+          else
+            SSH_PIN="-oStrictHostKeyChecking=accept-new"
+          fi
+          TAG="${{ gitea.ref_name }}"
+          ssh -i /tmp/dk -o BatchMode=yes $SSH_PIN deploy@10.0.0.105 bash -s "$TAG" << 'REMOTE'
+          set -euo pipefail
+          TAG="$1"
+          if command -v nextcraft >/dev/null 2>&1; then
+            echo "channel: binary/deb - the one-command upgrade (idempotent, self-verifying per deploy/README.md)"
+            nextcraft deploy --service --ref "$TAG"
+          elif [ -n "$(docker ps --format '{{.Names}}' | grep -x nextcraft || true)" ]; then
+            echo "channel: docker - README upgrade (pull + recreate; nextcraft-state persists)"
+            docker pull git.coreci.dev/coreci/nextcraft:"$TAG"
+            docker rm -f nextcraft
+            docker run -d --name nextcraft -p 8420:8420 -v nextcraft-state:/home/nextcraft/.nextcraft git.coreci.dev/coreci/nextcraft:"$TAG"
+          else
+            echo "FATAL: no nextcraft channel on $(hostname) (no nextcraft on PATH; no docker container named nextcraft) - failing loud"
+            exit 1
+          fi
+          echo "--- channel verify (advisory; the identity read below is canonical)"
+          command -v nextcraft >/dev/null 2>&1 && nextcraft --version || true
+          REMOTE
+          RC=$?
+          echo "host refresh done (rc=$RC); provenance: run id $GITHUB_RUN_ID / run #$GITHUB_RUN_NUMBER / job $GITHUB_JOB_ID / tag $TAG / sha $GITHUB_SHA"
+          exit $RC
+
+      - name: Post-deploy identity read - the R1 provenance surface
+        run: |
+          set -euo pipefail
+          TAG="${{ gitea.ref_name }}"
+          echo "waiting for the stack to settle..."
+          OK=""
+          for i in $(seq 1 12); do
+            CODE_H="$(curl -sS -o /tmp/h -m 15 -w '%{http_code}' https://nextcraft.coreci.dev/health || true)"
+            if [ "$CODE_H" = "200" ] && grep -q '"status"' /tmp/h; then OK=1; break; fi
+            sleep 5
+          done
+          [ -n "$OK" ] || { echo "FAIL: /health never returned 200 within the window"; exit 1; }
+          echo "assert 1/3: /health 200 - $(head -c 200 /tmp/h)"
+          CODE_R="$(curl -sS -o /tmp/r -m 15 -w '%{http_code}' https://nextcraft.coreci.dev/)"
+          head -c 64 /tmp/r | tr -d '[:space:]' | head -c 9 | grep -qiE '^<!doctype|^<html'             || { echo "FAIL: / is not HTML (code $CODE_R)"; exit 1; }
+          echo "assert 2/3: / serves HTML ($CODE_R)"
+          CODE_O="$(curl -sS -o /tmp/o -m 25 -w '%{http_code}' https://nextcraft.coreci.dev/openapi.json)"
+          grep -q '"/v1/placements/admin' /tmp/o             || { echo "FAIL: counting surface NOT registered on the served build (/openapi.json has no /v1/placements/admin routes) - honest red; R2 root-cause owns the diagnosis per c18619"; exit 1; }
+          echo "assert 3/3: /v1/placements/admin registered in /openapi.json"
+          echo "(advisory served version: $(grep -o '"version":"[^"]*"' /tmp/o | head -1))"
+          echo "PROVENANCE (R1): deploy run id $GITHUB_RUN_ID / run #$GITHUB_RUN_NUMBER / job $GITHUB_JOB_ID / tag $TAG / head $GITHUB_SHA - identity reads green"