fix(deploy): expand $unit locally in the health probe

Run 7 shipped everything, brought api and poller up, served /v1/ready through
the proxy — and failed on the last step with exit 4.

  ssh gitea_ci@"$API_HOST" "systemctl is-active \$unit.service"

The escaped \$unit is a leftover from when this ran inside a heredoc. Over a
plain ssh it sends a literal $unit for the *remote* shell to expand, against a
variable that only exists in the workflow's shell — so it ran
`systemctl is-active .service`, which is exit 4, unit not found. It was checking
nothing, and would have kept reporting healthy no matter what the units did.

Also pass -n to both probe sshs. ssh reads stdin by default, and that is a trap
waiting for whoever next pipes something into this step: the first ssh eats the
rest of the script and the remaining checks silently never run. (It bit the test
harness for this fix, which is how it was noticed.)

And say in a comment why tireless-runner is not probed: it refuses to start
until the interactive agent login exists, so probing it would make every deploy
red for something the deploy cannot fix.

Verified by extracting this step's body from the YAML and running it as a file,
the way Actions does:

  {"config":"ok","database":"not_implemented","forge":"not_implemented"}
  tireless-api: active
  tireless-poller: active

Refs #9

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013TxK1CWPkFXqdcXMJ4hVe6

.gitea/workflows/deploy.yaml

@@ -188,11 +188,24 @@ jobs:
         run: |
           # Probe from the proxy, over the mesh — the path a user actually takes.
           # A loopback probe on bob would pass even if firewalld were closed.
-          ssh gitea_ci@"$WEB_HOST" \
+          # -n on every probe ssh: without it ssh reads stdin, and a future
+          # edit that pipes anything into this step would have the first ssh
+          # swallow the rest of the script.
+          ssh -n gitea_ci@"$WEB_HOST" \
             "curl -fsS http://$API_HOST:$API_PORT/v1/ready"
+          echo
+          # $unit unescaped: it must expand HERE, in the workflow's shell. The
+          # escaped form is a leftover from when this ran inside a heredoc, and
+          # over a plain ssh it sends a literal `$unit` for the remote shell to
+          # expand against nothing — `systemctl is-active .service`, exit 4.
           for unit in tireless-api tireless-poller; do
-            ssh gitea_ci@"$API_HOST" "systemctl is-active \$unit.service"
+            printf '%s: ' "$unit"
+            ssh -n gitea_ci@"$API_HOST" "systemctl is-active $unit.service"
           done
+          # tireless-runner is deliberately not probed: it refuses to start
+          # until the interactive agent login exists on the host, which is a
+          # manual step. Adding it here would make every deploy red for a
+          # reason the deploy cannot fix.
 
       - name: startup journal
         if: always()