feat(deploy): conflict-free 'git pull' update flow (D001/D004/D005)

- deploy.sh: clean-tree guard + git fetch && git pull --ff-only + optional
  dep reinstall + app.db --migrate + restart.
- restart-service.sh: supervisor-agnostic restart (systemd or fallback), waits
  for an in-flight scan.
- check_runtime_git.sh: proves no scan writes git-tracked runtime data.
- ids.service: systemd unit template.
- tests/test_deployment.py: stdlib unittest invariant tests for the deployment
  runtime-isolation guarantee.

deploy/README.md

@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+#
+# Deployment support for the intrusion-detection IDS.
+#
+# This directory is intentionally small and uses no external framework:
+#   deploy.sh                  conflict-free `git pull` update wrapper (D004)
+#   ids.service               systemd unit template (D005)
+#   restart-service.sh         supervisor-agnostic restart shim (D005)
+#   check_runtime_git.sh       proves a scan never dirties tracked runtime files (D001)
+#
+# See .github/instructions/DEPLOYMENT.md for the full plan.
+
+set -euo pipefail