split pipeline into build (local) and deploy (server) workflows

.woodpecker/deploy.yml

@@ -0,0 +1,30 @@
+# UNT (NOVA) — Deploy Workflow
+#
+# Runs on the server-side agent (label: location=server).
+# Depends on build.yml completing — pulls the just-pushed images via the
+# public HTTPS path and runs docker compose on the host daemon.
+#
+# The edge compose dir is mounted read-only so we structurally cannot stomp
+# the server's .env (see ppl/def/ci-cd/auth-tiers.md context).
+
+when:
+  - event: manual
+
+labels:
+  location: server
+
+depends_on:
+  - build
+
+steps:
+  - name: deploy
+    image: docker:24-cli
+    commands:
+      - cd /edge
+      - docker compose pull
+      - docker compose up -d --remove-orphans
+      - docker image prune -f
+      - docker compose ps
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - /home/mariano/unt/ctrl/edge:/edge:ro