feat(runner): tgit-runner — сервисы в песочнице на хосте, деплой после push (#13)

- infra/runner/tgit-runner: deploy/restart/remove/list по SSH forced command;
  аргументы не исполняются и не глобятся; архив — только файлы и папки,
  без «..», ≤ 20 МБ, есть main.py; health_url — только localhost
- песочница: uid 10001, read-only, tmpfs noexec, cap-drop ALL,
  no-new-privileges, 128 МБ без swap, 0.25 CPU, 64 PID, --network none
  (сеть — только по egress-allow админа), лимит 10 сервисов, 2 образа
- новая версия стартует рядом (-next) и заменяет старую, только став
  healthy; иначе удаляется, старая работает, exit 3
- бот: после push git archive изменённых services/<name>/ → runner;
  автору — «🚀 работает» или «⛔ не развёрнут» с логом, команде — алерт ⛔;
  удалённая папка → remove; «♻️ Перезапустить» в «Статусе» для админа (S-5)
- examples/escape_attempts: все попытки выбраться — BLOCKED на живом Docker
- install.sh, authorized_keys.example; CD бота обновляет runner на хосте

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

app/runner/deployer.py

@@ -0,0 +1,85 @@
+"""After a push: the services it touched are (re)deployed through tgit-runner, the pusher hears how it went.
+
+A service = `services/<name>/`. Gone from the commit — removed on the host. A refused deploy keeps the old version
+running (the runner switches only to a healthy one) and raises ⛔ for the whole team.
+"""
+
+import asyncio
+import logging
+from collections.abc import Awaitable, Callable, Iterable
+from dataclasses import dataclass
+
+from app.alerts.detectors import Condition
+from app.alerts.service import AlertService
+from app.db.models import AlertKind
+from app.repo.git import GitError, UploadsRepo
+from app.runner.client import SERVICE, RunnerClient, RunnerResult
+
+log = logging.getLogger(__name__)
+
+
+def changed_services(paths: Iterable[str]) -> list[str]:
+    found = set()
+    for path in paths:
+        parts = path.split("/")
+        if len(parts) >= 3 and parts[0] == "services" and SERVICE.match(parts[1]):
+            found.add(parts[1])
+    return sorted(found)
+
+
+@dataclass(frozen=True)
+class Outcome:
+    service: str
+    result: RunnerResult
+    removed: bool = False
+
+
+Report = Callable[[Outcome], Awaitable[None]]
+
+
+class Deployer:
+    def __init__(self, repo: UploadsRepo, runner: RunnerClient, alerts: AlertService | None = None) -> None:
+        self._repo = repo
+        self._runner = runner
+        self._alerts = alerts
+        self._lock = asyncio.Lock()  # one deploy at a time: builds are heavy for the shared host
+        self._tasks: set[asyncio.Task[None]] = set()
+
+    def schedule(self, sha: str, paths: Iterable[str], report: Report) -> list[str]:
+        """Start in the background; returns the services that will be deployed."""
+        services = changed_services(paths)
+        if services:
+            task = asyncio.create_task(self.deploy(sha, services, report))
+            self._tasks.add(task)
+            task.add_done_callback(self._tasks.discard)
+        return services
+
+    async def deploy(self, sha: str, services: list[str], report: Report) -> None:
+        async with self._lock:
+            for service in services:
+                try:
+                    outcome = await self._one(sha, service)
+                except Exception:  # one broken service must not stop the others
+                    log.exception("deploy %s @ %s", service, sha[:7])
+                    outcome = Outcome(service, RunnerResult(False, -1, "internal error", ""))
+                if not outcome.result.ok and self._alerts is not None:
+                    await self._alerts.event(
+                        Condition(
+                            AlertKind.DEPLOY_REFUSED,
+                            f"tgit-svc-{service}",
+                            {"detail": outcome.result.summary, "sha": sha[:7], "log": outcome.result.tail},
+                        )
+                    )
+                try:
+                    await report(outcome)
+                except Exception:
+                    log.exception("deploy report for %s", service)
+
+    async def _one(self, sha: str, service: str) -> Outcome:
+        tree = f"{sha}:services/{service}"
+        try:
+            await self._repo.git("cat-file", "-e", tree)
+        except GitError:
+            return Outcome(service, await self._runner.run("remove", service), removed=True)
+        archive = await self._repo.git("archive", "--format=tar", tree)
+        return Outcome(service, await self._runner.deploy(service, sha, archive))