deploy: machine deployment — quadlets (gitea, nginx, isolated build network), poll+build pipeline, runbook

Reviewed (Opus security review, all findings verified) and tested end-to-end
locally: cold build 23s, no-op poll 45ms, incremental rebuild 4s, prune,
gitea-down grace, real bridge network with container DNS.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012jWfn3RwPfFGTtBddm36Uy

deploy/ctao-demo.network

@@ -0,0 +1,11 @@
+# CTAO portal demo — dedicated bridge network (quadlet .network unit).
+# Why it exists: the build container executes npm lifecycle scripts from the
+# repo, so it must NOT see the host's loopback (code-server, Strapi). On this
+# bridge, containers resolve each other by name (aardvark-dns) and have NATed
+# internet egress, but host 127.0.0.1 services are unreachable — unlike
+# --network=host, which this replaces.
+[Unit]
+Description=CTAO portal demo — internal bridge network
+
+[Network]
+NetworkName=ctao-demo