deploy: machine deployment — quadlets (gitea, nginx, isolated build network), poll+build pipeline, runbook

Reviewed (Opus security review, all findings verified) and tested end-to-end
locally: cold build 23s, no-op poll 45ms, incremental rebuild 4s, prune,
gitea-down grace, real bridge network with container DNS.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012jWfn3RwPfFGTtBddm36Uy

deploy/ctao-demo-web.container

@@ -0,0 +1,25 @@
+# CTAO portal demo — static web server. Serves ~/ctao-portal-demo/releases/current
+# (a symlink the build flips atomically). Read-only mounts: nginx can only read.
+# Quadlet unit → service name: ctao-demo-web.service.
+
+[Unit]
+Description=CTAO portal demo — static web server (nginx)
+Wants=network-online.target
+After=network-online.target
+
+[Container]
+ContainerName=ctao-demo-web
+# Official image; re-pin to the exact digest at install (same drill as Gitea).
+Image=docker.io/library/nginx:stable-alpine
+# releases/ is shared with the build container (:z shared label);
+# the config file is exclusive to nginx (:Z).
+Volume=%h/ctao-portal-demo/releases:/srv/releases:ro,z
+Volume=%h/ctao-portal-demo/config/nginx.conf:/etc/nginx/conf.d/default.conf:ro,Z
+PublishPort=8080:80
+
+[Service]
+Restart=on-failure
+MemoryHigh=64M
+
+[Install]
+WantedBy=default.target