fix(ci): sync the server checkout after deployment

Fast-forward the deployment checkout to the exact healthy image commit while refusing tracked changes, divergence, or an unexpected branch. Ignore release metadata stored beside the checkout.

DEPLOYMENT.md

@@ -9,6 +9,9 @@ Release manifests are stored in `<DEPLOY_PATH>/releases/<commit-sha>`. Each
 manifest records the immutable image tag and Gitea run number. The `current`
 symlink is changed only after the new container is healthy. If startup fails,
 the deployment script restarts the previous image without rebuilding it.
+After health succeeds, the Git checkout at `<DEPLOY_PATH>` is fast-forwarded to
+the exact deployed commit. Deployment refuses to overwrite tracked server-side
+changes or a checkout that has diverged from `origin/main`.
 
 ## Gitea Actions setup