fix: deploy hook git pull without writable global config

Use git -c safe.directory instead of git config --global in the
container; set HOME=/tmp for deploy-hook.

Co-authored-by: Cursor <cursoragent@cursor.com>

compose.yml

@@ -24,6 +24,7 @@ services:
       - .:/repo
       - ./hooks:/etc/webhook:ro
     environment:
+      - HOME=/tmp
       - WEBHOOK_SECRET=${WEBHOOK_SECRET}
       - DEPLOY_GIT_TOKEN=${DEPLOY_GIT_TOKEN:-}
       - DEPLOY_BRANCH=${DEPLOY_BRANCH:-main}