ci: replace watchtower trigger with SSH deploy

Watchtower recreated containers outside their podman-compose pod, which took
gitea down for three days on 2026-08-14 while reporting failed=0. It is retired.

Deploys now SSH to the VPS and restart the systemd unit, so podman-compose
rebuilds the project properly. The key is pinned to a forced command that only
accepts a service name.

Still non-fatal: the image is already pushed and podman-update.timer sweeps at
midnight, so a trigger failure delays the deploy rather than failing the build.

.gitea/workflows/build.yml

@@ -33,10 +33,26 @@ jobs:
       - name: Build and push image
         run: docker build --push -f docker/Dockerfile -t git.gbrown.org/gib/agentchat:${{ gitea.sha }} -t git.gbrown.org/gib/agentchat:latest .
 
-      # Watchtower on the VPS updates labelled containers nightly at 04:30; this
-      # asks it to do so immediately. Non-fatal: the sweep still catches it.
-      - name: Trigger immediate deploy via Watchtower API
+      # Watchtower was retired 2026-08-17: it recreated containers outside their
+      # podman-compose pod, which took gitea down for three days while reporting
+      # success. Deploys now SSH to the VPS and restart the systemd UNIT, so
+      # podman-compose rebuilds the project properly (pod, networks, ports).
+      #
+      # The key is pinned to a forced command that accepts only a service name, so
+      # it cannot open a shell or reach anything else. 192.168.2.2 is the VPS over
+      # WireGuard: reachable from every runner, never the public internet.
+      #
+      # Non-fatal on purpose: the image is already pushed, and podman-update.timer
+      # sweeps at midnight, so a trigger hiccup delays the deploy by hours rather
+      # than failing a build that otherwise succeeded.
+      - name: Trigger immediate deploy
         run: |
-          curl -fsS -X POST -H "Authorization: Bearer ${{ secrets.WATCHTOWER_TOKEN }}" \
-            http://192.168.2.2:8080/v1/update \
-            || echo "::warning::watchtower trigger failed; nightly sweep will deploy instead"
+          echo "${{ secrets.DEPLOY_SSH_KEY }}" > "$HOME/.deploy_key"
+          chmod 600 "$HOME/.deploy_key"
+          ssh -i "$HOME/.deploy_key" \
+              -o BatchMode=yes \
+              -o StrictHostKeyChecking=accept-new \
+              -o ConnectTimeout=15 \
+              [email protected] agentchat \
+            || echo "::warning::deploy trigger failed; nightly sweep will deploy instead"
+          rm -f "$HOME/.deploy_key"