Add idempotent deploy helper and GitHub workflow that runs on the self-hosted Evo runner (no SSH secrets). Pulls main or a pinned SHA, migrates, restarts via systemd/tmux/compose, probes :3100/:5173, and resets on health failure. Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>