On a push to main the asgard-hosted runner SSHes back to the host (forced-command key, docker bridge gateway, port 2222) and runs deploy/deploy.sh — replacing the 2-minute systemd poller. Build/publish still happens on the dev machine before push.
