fix: deploy hook git pull without writable global config

Use git -c safe.directory instead of git config --global in the
container; set HOME=/tmp for deploy-hook.

Co-authored-by: Cursor <cursoragent@cursor.com>

hooks/deploy.sh

@@ -3,21 +3,24 @@ set -euo pipefail
 
 REPO_DIR="/repo"
 BRANCH="${DEPLOY_BRANCH:-main}"
-REMOTE_URL="${DEPLOY_GIT_URL:-https://gitea.schwenk.online/froxxxy/playground.git}"
 
 if [ ! -d "${REPO_DIR}/.git" ]; then
   echo "Error: ${REPO_DIR} is not a git repository"
   exit 1
 fi
 
-git config --global --add safe.directory "${REPO_DIR}"
 cd "${REPO_DIR}"
 
+# Container has no writable $HOME — avoid git config --global (//.gitconfig)
+git_cmd() {
+  git -c "safe.directory=${REPO_DIR}" "$@"
+}
+
 if [ -n "${DEPLOY_GIT_TOKEN:-}" ]; then
   auth_url="https://oauth2:${DEPLOY_GIT_TOKEN}@gitea.schwenk.online/froxxxy/playground.git"
-  git pull "${auth_url}" "${BRANCH}"
+  git_cmd pull "${auth_url}" "${BRANCH}"
 else
-  git pull origin "${BRANCH}"
+  git_cmd pull origin "${BRANCH}"
 fi
 
 echo "Deploy pull completed for ${BRANCH}"