docs site: deploy from a dedicated clean clone; poll against last deployed commit

- docs-deploy-poll.service and the receiver now build from
  /home/ubuntu/.docs-publisher, so uncommitted edits in a working clone can
  never block a deploy
- the poller compares origin/main against the last DEPLOYED commit (state
  file), so a push made from the deploy clone itself also triggers a deploy

publishing/README.md

@@ -59,6 +59,11 @@ about a minute, with no human action. The Gitea webhook alone was not enough
 because the agent host's cloud firewall only admits inbound SSH — a webhook
 POST is silently dropped — while outbound access to Gitea works.
 
+The service builds from a **dedicated clean clone** at
+`/home/ubuntu/.docs-publisher`, not from anyone's working copy, so uncommitted
+edits in a working clone can never block a deploy. Edit, commit, push — that
+is the whole deployment story.
+
 **Webhook (wired, waiting on one port).** A Gitea webhook is registered on
 `co-op/docs` (push events, branch `main`) pointing at the receiver below. The
 moment the Infomaniak panel allows inbound TCP to the agent host — port 8787