deploy: machine deployment — quadlets (gitea, nginx, isolated build network), poll+build pipeline, runbook

Reviewed (Opus security review, all findings verified) and tested end-to-end
locally: cold build 23s, no-op poll 45ms, incremental rebuild 4s, prune,
gitea-down grace, real bridge network with container DNS.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012jWfn3RwPfFGTtBddm36Uy

deploy/ctao-portal-build.service

@@ -0,0 +1,15 @@
+# CTAO portal demo — rebuild-on-new-commit worker (fired by the .timer).
+# Install: copy to ~/.config/systemd/user/ → systemctl --user daemon-reload.
+# Type=oneshot + timer means runs can never overlap: the timer will not
+# activate a service that is still running.
+
+[Unit]
+Description=CTAO portal demo — rebuild if the content repo has new commits
+
+[Service]
+Type=oneshot
+ExecStart=%h/ctao-portal-demo/bin/build.sh
+# Polite neighbour on the shared VM:
+Nice=10
+# First-ever npm ci on 2 vCPU can be slow; normal rebuilds are seconds.
+TimeoutStartSec=900