ci: deploy over a pinned, single-purpose key instead of root

deploy-vps reached subquery1 as root, through appleboy/ssh-action referenced
by tag, with a key whose comment (mamostehp@MamostePC) made it look like a
person's. It now uses plain ssh with SUBQUERY_DEPLOY_KEY, which the host pins
(authorized_keys restrict,command=) to ops/host/subquery-deploy-ssh: the
commit SHA is its only input. subquery-deploy, run through sudo, does what
the workflow's script did, with three changes:

- It deploys exactly the SHA CI was triggered for, and only a commit on main.
- The host's local edits to tracked files (the indexer manifests) are put
  back whether the deploy succeeds or fails. Before, a failed build exited
  before `stash pop` and left them stashed.
- Only tracked files are stashed. Stashing untracked ones too (.yarn/, which
  yarn install recreates) made every pop fail half-way; that is how 13 stash
  entries piled up on the host.

test-deploy.sh covers this against a scratch clone (red with the restore
trap removed); CI runs it with shellcheck. subquery1's host key is pinned.
The indexer endpoints themselves are unchanged. Actions pinned to SHAs; the
secret scanner's own AGPL licence is allowed in dependency review.

ops/host/subquery-deploy

@@ -0,0 +1,44 @@
+#!/bin/bash
+# Brings /opt/subquery to a commit of main and rebuilds and restarts the
+# compose stack (indexers, noter and payout bots). Installed root-owned at
+# /usr/local/sbin/subquery-deploy; reached only through subquery-deploy-ssh.
+#
+# The host keeps local edits to tracked files (the indexer manifests point at
+# a host-specific endpoint). They are stashed for the pull and always put
+# back, whether the deploy succeeds or not. Only tracked files are stashed:
+# stashing untracked ones too (.yarn/, which yarn install recreates) made
+# every pop fail half-way and left a stash entry behind on each deploy.
+set -euo pipefail
+
+SHA="${1:-}"
+if ! [[ "$SHA" =~ ^[0-9a-f]{40}$ ]]; then
+  echo "subquery-deploy: expected the 40-character commit SHA to deploy" >&2
+  exit 2
+fi
+
+cd /opt/subquery
+
+stashed=
+if ! git diff --quiet; then
+  git stash push -q -m "subquery-deploy $SHA"
+  stashed=1
+fi
+restore () {
+  if [ -n "$stashed" ]; then
+    git stash pop -q || echo "subquery-deploy: could not restore the host's local edits; they are in 'git stash list'" >&2
+  fi
+}
+trap restore EXIT
+
+git fetch -q origin main
+# Deploy exactly what CI tested, and only a commit that is on main.
+git merge-base --is-ancestor "$SHA" origin/main || { echo "subquery-deploy: $SHA is not on main" >&2; exit 1; }
+git merge -q --ff-only origin/main
+[ "$(git rev-parse HEAD)" = "$SHA" ] || { echo "subquery-deploy: main is at $(git rev-parse --short HEAD), not ${SHA:0:7}; a newer deploy will follow" >&2; exit 1; }
+
+yarn install --frozen-lockfile
+./node_modules/.bin/subql codegen pezkuwi-governance.yaml
+./node_modules/.bin/subql build pezkuwi.yaml
+docker compose -f docker-compose.prod.yml build
+docker compose -f docker-compose.prod.yml up -d
+echo "subquery-deploy: deployed ${SHA:0:7}"

ops/host/subquery-deploy-ssh

@@ -0,0 +1,18 @@
+#!/bin/bash
+# Forced command for the subquery deploy key, installed root-owned at
+# /usr/local/sbin/subquery-deploy-ssh:
+#
+#   restrict,command="/usr/local/sbin/subquery-deploy-ssh" ssh-ed25519 ...
+#
+# CI runs `ssh subquery-deploy@<host> <commit sha>`. The SHA is the only
+# input; subquery-deploy, which sudo lets this user run and nothing else,
+# does the work.
+set -euo pipefail
+
+SHA="${SSH_ORIGINAL_COMMAND:-}"
+if ! [[ "$SHA" =~ ^[0-9a-f]{40}$ ]]; then
+  echo "subquery-deploy-ssh: expected the 40-character commit SHA to deploy" >&2
+  exit 2
+fi
+
+exec sudo -n /usr/local/sbin/subquery-deploy "$SHA"

ops/host/test-deploy.sh

@@ -0,0 +1,66 @@
+#!/bin/bash
+# The rc variables are read inside the check expressions, which check() runs
+# with eval; shellcheck cannot see into those strings.
+# shellcheck disable=SC2034
+# Exercises subquery-deploy's git handling against a scratch clone: the host's
+# local edits come back whether the deploy succeeds or fails, no stash entry
+# is left behind, untracked files (.yarn/) do not get in the way, and only a
+# commit on main is deployed. yarn, subql and docker are replaced with a
+# command that succeeds, or with one that fails.
+set -uo pipefail
+
+HERE=$(cd "$(dirname "$0")" && pwd)
+T=$(mktemp -d)
+trap 'rm -rf "$T"' EXIT
+git() { command git -c user.email=t@t -c user.name=t "$@"; }
+
+git init -q --bare -b main "$T/origin.git"
+git clone -q "$T/origin.git" "$T/work" 2>/dev/null
+( cd "$T/work" && echo 'endpoint: repo' > pezkuwi.yaml && git add . && git commit -qm one && git push -q origin main )
+git clone -q "$T/origin.git" "$T/host" 2>/dev/null
+( cd "$T/host" && echo 'endpoint: host-local' > pezkuwi.yaml && mkdir .yarn && echo cache > .yarn/x )
+
+make_script () {  # make_script <build command>
+  sed -e "s#^cd /opt/subquery\$#cd $T/host#" \
+      -e "s#^yarn install --frozen-lockfile\$#$1#" \
+      -e 's#^\./node_modules/\.bin/subql .*$#true#' \
+      -e 's#^docker compose .*$#true#' \
+      "$HERE/subquery-deploy" > "$T/deploy"
+  chmod +x "$T/deploy"
+}
+push_commit () { ( cd "$T/work" && echo "$1" > other.txt && git add . && git commit -qm "$1" && git push -q origin main && git rev-parse HEAD ); }
+
+pass=0; fail=0
+check () { if eval "$2"; then echo "ok    $1"; pass=$((pass+1)); else echo "FAIL  $1"; fail=$((fail+1)); fi; }
+host_edit () { grep -q host-local "$T/host/pezkuwi.yaml"; }
+stashes () { (cd "$T/host" && git stash list | wc -l); }
+
+make_script true
+S2=$(push_commit two)
+"$T/deploy" "$S2" >/dev/null 2>&1; rc=$?
+check "a deploy of main's head succeeds"                '[ $rc = 0 ] && [ "$(cd "$T/host" && git rev-parse HEAD)" = "$S2" ]'
+check "the host's local edit is back"                   'host_edit'
+check "no stash entry is left"                          '[ "$(stashes)" = 0 ]'
+check "untracked files are untouched"                   '[ -f "$T/host/.yarn/x" ]'
+
+make_script false
+S3=$(push_commit three)
+"$T/deploy" "$S3" >/dev/null 2>&1; rc=$?
+check "a failing build fails the deploy"                '[ $rc != 0 ]'
+check "the local edit is back after a failure"          'host_edit && [ "$(stashes)" = 0 ]'
+
+make_script true
+S4=$(push_commit four); S5=$(push_commit five)
+"$T/deploy" "$S4" >/dev/null 2>&1; rc=$?
+check "a SHA behind main's head is not deployed"        '[ $rc != 0 ] && host_edit && [ "$(stashes)" = 0 ]'
+
+( cd "$T/work" && git checkout -qb side && echo x > side.txt && git add . && git commit -qm side && git push -q origin side )
+SIDE=$(cd "$T/work" && git rev-parse HEAD)
+"$T/deploy" "$SIDE" >/dev/null 2>&1; rc=$?
+check "a commit that is not on main is refused"          '[ $rc != 0 ] && [ "$(cd "$T/host" && git rev-parse HEAD)" != "$SIDE" ] && host_edit'
+
+"$T/deploy" 'abc; id' >/dev/null 2>&1; rc=$?
+check "anything but a full SHA is refused"               '[ $rc = 2 ]'
+
+echo "RESULT: $pass passed, $fail failed"
+[ "$fail" = 0 ]