fix(deploy): restart the worker after the hub key, diff against what was deployed

- The provisioning worker boots before install.sh writes
  CLUPILOT_WG_HUB_PUBKEY and holds the empty value for the life of its process,
  so every host onboarded afterwards would have got an empty PublicKey in its
  wg0.conf.
- A failed update left the checkout at the target, so the rerun compared a
  commit with itself and skipped exactly the dependency and image steps that had
  not finished. The comparison base is now the last commit actually deployed.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

deploy/install.sh

@@ -230,6 +230,10 @@ fi
 HUB_PUBKEY="$(compose exec -T queue-provisioning sh -c 'wg pubkey < /etc/wireguard/hub.key' | tr -d '\r\n')"
 sed -i "s|^CLUPILOT_WG_HUB_PUBKEY=.*|CLUPILOT_WG_HUB_PUBKEY=${HUB_PUBKEY}|" .env
 compose exec -T app php artisan config:clear >/dev/null
+# The worker booted before that key existed and holds the old value for the life
+# of its process — host onboarding would write an empty PublicKey into every
+# host's wg0.conf until someone restarted it.
+compose restart queue-provisioning >/dev/null
 
 # ── 7. Your account ──────────────────────────────────────────────────────────
 log "Creating your Owner account"

deploy/update.sh

@@ -57,6 +57,15 @@ if [[ "$before" == "$target" && "$deployed" == "$target" ]]; then
     exit 0
 fi
 
+# What the change checks below compare against. After a failed run the checkout
+# is already at the target, so diffing against it would compare a commit with
+# itself and skip the very steps that did not finish — the base has to be the
+# last commit we actually deployed.
+base="$before"
+if [[ -n "$deployed" ]] && git cat-file -e "${deployed}^{commit}" 2>/dev/null; then
+    base="$deployed"
+fi
+
 if [[ "$before" != "$target" ]]; then
     log "Updating $(git rev-parse --short "$before") → $(git rev-parse --short "$target")"
     git --no-pager log --oneline "$before..$target" | sed 's/^/    /'
@@ -73,7 +82,7 @@ git merge --quiet --ff-only "origin/$BRANCH"
 after="$(git rev-parse HEAD)"
 
 # The image is only rebuilt when its definition changed — minutes versus seconds.
-if ! git diff --quiet "$before" "$after" -- docker/ 2>/dev/null; then
+if ! git diff --quiet "$base" "$after" -- docker/ 2>/dev/null; then
     log "Rebuilding the image"
     docker compose build --quiet app
     # Recreate now, not at the end: everything below runs INSIDE this container,
@@ -89,12 +98,12 @@ fi
 # vendor/ and node_modules/ live in the bind mount, so they shadow whatever the
 # image contains: rebuilding the image does NOT update them. Install explicitly
 # whenever a lockfile moved, or the migration below runs against stale packages.
-if ! git diff --quiet "$before" "$after" -- composer.json composer.lock 2>/dev/null || [[ ! -d vendor ]]; then
+if ! git diff --quiet "$base" "$after" -- composer.json composer.lock 2>/dev/null || [[ ! -d vendor ]]; then
     log "Installing PHP dependencies"
     in_app composer install --no-interaction --no-dev --prefer-dist --no-progress --optimize-autoloader
 fi
 
-if ! git diff --quiet "$before" "$after" -- package.json package-lock.json 2>/dev/null || [[ ! -d node_modules ]]; then
+if ! git diff --quiet "$base" "$after" -- package.json package-lock.json 2>/dev/null || [[ ! -d node_modules ]]; then
     log "Installing JS dependencies"
     in_app npm ci --no-fund --no-audit
 fi