feat(release): systemd watcher units + dev run-mount + flag-gated install

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docker-compose.yml

@@ -14,6 +14,7 @@ x-app: &app
   restart: unless-stopped
   volumes:
     - .:/var/www/html
+    - ./run:/var/www/html/storage/app/restart-signal
   networks:
     - clusev
 

docker/release/clusev-release-request.path

@@ -0,0 +1,11 @@
+[Unit]
+Description=Clusev release write-request — watch for a dashboard request
+After=docker.service
+Wants=docker.service
+
+[Path]
+PathExists=/home/nexxo/clusev/run/release-request.json
+Unit=clusev-release-request.service
+
+[Install]
+WantedBy=multi-user.target

docker/release/clusev-release-request.service

@@ -0,0 +1,11 @@
+[Unit]
+Description=Clusev release write-request handler
+After=docker.service
+
+[Service]
+Type=oneshot
+User=nexxo
+UMask=0077
+Environment=CLUSEV_DIR=/home/nexxo/clusev
+WorkingDirectory=/home/nexxo/clusev
+ExecStart=/home/nexxo/clusev/docker/release/clusev-release.sh serve-request

install.sh

@@ -325,6 +325,19 @@ install_host_watchers() {
     warn "Host-Watcher konnten nicht installiert werden — siehe ${src}/README.md."
   fi
   rm -f "$tmp_path" "$tmp_svc" "$tmp_upath" "$tmp_usvc" "$tmp_gate" "$tmp_csvc" "$tmp_ctimer" "$tmp_rsvc" "$tmp_rpath"
+
+  # Release bridge units — DEV ONLY. Installed only when CLUSEV_RELEASE_CONTROLS=true is set in .env,
+  # so customer/staging installs never get release controls or a host git-push watcher.
+  if grep -qE '^CLUSEV_RELEASE_CONTROLS=true$' "${proj}/.env" 2>/dev/null; then
+    local tmp_relsvc tmp_relpath; tmp_relsvc="$(mktemp)"; tmp_relpath="$(mktemp)"
+    sed "s#/home/nexxo/clusev#${proj}#g" "docker/release/clusev-release-request.service" > "$tmp_relsvc"
+    sed "s#/home/nexxo/clusev#${proj}#g" "docker/release/clusev-release-request.path"    > "$tmp_relpath"
+    install -m 0644 "$tmp_relsvc"  "${dst}/clusev-release-request.service"
+    install -m 0644 "$tmp_relpath" "${dst}/clusev-release-request.path"
+    rm -f "$tmp_relsvc" "$tmp_relpath"
+    systemctl daemon-reload
+    systemctl enable --now clusev-release-request.path
+  fi
 }
 install_host_watchers