deploy: machine deployment — quadlets (gitea, nginx, isolated build network), poll+build pipeline, runbook

Reviewed (Opus security review, all findings verified) and tested end-to-end
locally: cold build 23s, no-op poll 45ms, incremental rebuild 4s, prune,
gitea-down grace, real bridge network with container DNS.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012jWfn3RwPfFGTtBddm36Uy

deploy/ctao-portal-build.timer

@@ -0,0 +1,18 @@
+# CTAO portal demo — poll cadence for the build worker.
+# OnUnitInactiveSec: next tick 10 s after the previous run FINISHES (it is
+# deactivation-relative; OnUnitActiveSec would be start-relative). Overlap is
+# impossible either way — a timer never activates a still-running unit.
+# OnActiveSec covers `systemctl --user enable --now` (first tick 5 s later);
+# OnBootSec covers reboot. Enable: systemctl --user enable --now ctao-portal-build.timer
+
+[Unit]
+Description=CTAO portal demo — poll the content repo every 10 s
+
+[Timer]
+OnActiveSec=5
+OnBootSec=30
+OnUnitInactiveSec=10
+AccuracySec=1s
+
+[Install]
+WantedBy=timers.target