Deploy pipeline

Deploys are tracked as atomic database records, claimed by concurrent worker slots (NINEDEPLOY_DEPLOY_CONCURRENCY, default 1, max 8). The same service is never deployed concurrently. Stranded deployments from abrupt restarts are swept automatically on boot.

• Trigger: manual UI button, webhook (HMAC + branch + watch-path globs + replay dedup), CLI command, cron schedule, or template hub.
• Build: git clone with credentials (scrubbed after checkout) or Docker image pull with per-source registry credentials.
• Blue-green: the new container starts on the shared network while the existing version continues handling live traffic.
• Healthcheck: container liveness check plus HTTP probes against the container IP — isolated per attempt with hard timeouts.
• Flip: Traefik's dynamic routing configuration is rewritten atomically; only then is the previous container retired.
• Automatic rollback: on failure, the new container is destroyed and the previous healthy release keeps running.
• Cancellation: in-flight builds can be cancelled at any stage, immediately stopping subprocesses and cleaning up containers.