docs site: deploy from a dedicated clean clone; poll against last deployed commit

- docs-deploy-poll.service and the receiver now build from
  /home/ubuntu/.docs-publisher, so uncommitted edits in a working clone can
  never block a deploy
- the poller compares origin/main against the last DEPLOYED commit (state
  file), so a push made from the deploy clone itself also triggers a deploy

publishing/poll-watcher.sh

@@ -19,6 +19,7 @@ REPO_DIR="${DOCS_REPO_DIR:-/home/ubuntu/repos/docs}"
 ENV_FILE="${DOCS_ENV_FILE:-/home/ubuntu/.hermes/.env}"
 LOG_FILE="${DOCS_DEPLOY_LOG:-/home/ubuntu/docs-deploy.log}"
 LOCK_FILE="${DOCS_DEPLOY_LOCK:-/home/ubuntu/.docs-deploy.lock}"
+STATE_FILE="${DOCS_DEPLOY_STATE:-/home/ubuntu/.docs-deploy.state}"
 INTERVAL="${DOCS_POLL_INTERVAL:-60}"
 
 cd "$REPO_DIR"
@@ -43,11 +44,13 @@ while true; do
     continue
   fi
 
-  LOCAL="$(git rev-parse HEAD 2>/dev/null || echo none)"
   REMOTE="$(git rev-parse origin/main 2>/dev/null || echo none)"
+  # Compare against the commit last DEPLOYED (not the clone's HEAD): a push
+  # made from this very clone would otherwise look like "no change".
+  LAST_DEPLOYED="$(cat "$STATE_FILE" 2>/dev/null || echo none)"
 
-  if [ "$LOCAL" != "$REMOTE" ]; then
-    log "main moved: $LOCAL -> $REMOTE; deploying"
+  if [ "$LAST_DEPLOYED" != "$REMOTE" ]; then
+    log "main moved: ${LAST_DEPLOYED:0:12} -> ${REMOTE:0:12}; deploying"
     # flock -n shares the receiver's lock: one deploy at a time, ever.
     if flock -n "$LOCK_FILE" bash -c '
       set -e
@@ -56,9 +59,10 @@ while true; do
       bash publishing/build.sh
       bash publishing/deploy.sh
     ' _ "$REPO_DIR" >>"$LOG_FILE" 2>&1; then
-      log "deploy finished for $REMOTE"
+      printf '%s\n' "$REMOTE" > "$STATE_FILE"
+      log "deploy finished for ${REMOTE:0:12}"
     else
-      log "deploy FAILED for $REMOTE (see log above)"
+      log "deploy FAILED for ${REMOTE:0:12} (see log above)"
     fi
   fi