deploy

type Config struct {
	Remote       string        // git remote name in the workspace clone (read-only)
	Workspace    string        // persistent clone + cargo/go caches; builds run here
	ReleasesDir  string        // immutable release snapshots: <ReleasesDir>/<tag>/
	CurrentLink  string        // `current` symlink the systemd unit ExecStarts through
	ServiceName  string        // systemd unit restarted on swap
	ScratchPort  int           // gate: candidate carrier loopback port
	GateAUs      int           // gate: access units ws_probe must receive
	GateTimeout  time.Duration // gate: overall budget
	LivePort     int           // post-restart health probe: the demo service's listen port
	KeepReleases int           // retain the last K release dirs (rollback history)
	// RequireSignedTags gates building on a valid GPG/SSH tag signature (SD8);
	// false is a loopback/dev escape only.
	RequireSignedTags bool
	EncoderArgs       string // IMZERO2_HEADLESS_ENCODER_ARGS for the gate run
	MainFont          string // optional; fc-match'd if empty
	PhosphorFont      string // optional; the release's bundled asset if empty
	FallbackFont      string // optional; fc-match'd if empty
	DryRun            bool   // stage + gate but skip the swap + restart
	// Ref, when set, is the operator out-of-cadence path (SD10): deploy this
	// exact revision (commit/branch/tag) now, bypassing tag-selection, with its
	// commit signature verified like a tag (SD11). Empty = the autonomous tag poll.
	Ref string
	// Root is the deploy root (<root>/{workspace,releases,current}); the
	// append-only break-glass audit log (SD11) lives here.
	Root string
}