fix(cd): keep deploy checkout on main ref

.gitea/workflows/cd.yaml

@@ -1311,7 +1311,8 @@ jobs:
           git remote remove origin 2>/dev/null || true
           git remote add origin "$GITEA_SOURCE_URL"
           git fetch --no-tags --prune --depth=1 origin "$GITHUB_SHA"
-          git checkout --force --detach FETCH_HEAD
+          # Deploy marker creation and push require a real local main ref.
+          git checkout --force -B main FETCH_HEAD
 
       - name: Wait for Host Web Build Pressure
         # 2026-06-27 Codex: post-deploy smoke is also browser-heavy. Refuse to

apps/api/tests/test_signal_worker_ansible_executor_binding.py

@@ -115,6 +115,7 @@ def test_cd_prunes_and_verifies_api_executor_boundary_in_production() -> None:
     assert "delete pods --all-namespaces" in workflow
     assert "repair-ssh-key|repair-known-hosts|ssh-mcp-key" in workflow
     assert "github.com/kubernetes-sigs/kustomize" not in workflow
+    assert "git checkout --force -B main FETCH_HEAD" in workflow
 
 
 def test_gitea_workflows_never_download_github_actions() -> None: