phase 6: deploy pipeline — CI, cutover checklist, watchdog, verification, rollback

- scripts/deploy.sh: Gitea webhook-triggered deploy (git pull → docker build
  → compose up → health check). SHA-tagged images, rolling restart.
- scripts/watchdog.sh: cron health check every 2min, pages operator via
  Matrix after 3 consecutive failures. Reset on recovery.
- scripts/verify-phase6.sh: 14 end-to-end verification checks against
  plan V1–V14 (ontology, DB, API, scheduler, actuator, learning, classifier,
  hermes, secrets, deploy, knowledge, observability, correlation, cutover).
- scripts/rollback.sh: re-deploy previous SHA tag + pg_restore from
  pre-deploy dump. Health check loop, returns to main branch after.
- scripts/cutover-checklist.md: pre/post-cutover steps — backup, CI gate,
  Caddy re-point, DNS, apps/105 disable, cleanup.
- compose/caddy/Caddyfile.oikos: reverse-proxy config for
  oikos/mcp/hermes.hubris.network → mac-mini mesh IP.
- .gitignore: added bin/ to exclude compiled binaries.

14/14 verification checks pass against running Docker stack.

scripts/rollback.sh

@@ -0,0 +1,63 @@
+#!/bin/sh
+# Oikos rollback — redeploys previous SHA tag and restores DB from pre-deploy dump.
+# Usage: ./scripts/rollback.sh <previous-sha>
+# Phase 6 acceptance: rehearsed once before going live.
+
+set -e
+
+PREVIOUS_SHA="${1:-}"
+if [ -z "$PREVIOUS_SHA" ]; then
+    echo "usage: $0 <previous-sha>"
+    echo "  e.g. $0 abc1234"
+    exit 1
+fi
+
+PROFILE="${PROFILE:-full}"
+DUMP_DIR="${DUMP_DIR:-/opt/oikos/backups}"
+HEALTH_URL="${HEALTH_URL:-http://localhost:8090/healthz}"
+REPO_DIR="${REPO_DIR:-/opt/oikos}"
+
+cd "$REPO_DIR"
+
+echo "=== OIKOS ROLLBACK to $PREVIOUS_SHA ==="
+echo ""
+
+# 1. Stop services
+echo "[1/4] stopping services"
+docker compose --profile "$PROFILE" down
+
+# 2. Restore DB from pre-deploy dump
+echo "[2/4] restoring database"
+DUMP_FILE="$DUMP_DIR/pre-deploy-$(echo $PREVIOUS_SHA | cut -c1-7).sql"
+if [ -f "$DUMP_FILE" ]; then
+    docker compose --profile "$PROFILE" up -d postgres
+    sleep 5
+    docker compose exec -T postgres psql -U oikos -d oikos < "$DUMP_FILE"
+    echo "DB restored from $DUMP_FILE"
+else
+    echo "WARNING: no dump found at $DUMP_FILE — proceeding with current DB"
+fi
+
+# 3. Checkout previous SHA
+echo "[3/4] checking out $PREVIOUS_SHA"
+git checkout "$PREVIOUS_SHA"
+
+# 4. Rebuild and restart
+echo "[4/4] rebuild and restart"
+DOCKER_BUILDKIT=1 docker compose --profile "$PROFILE" build
+docker compose --profile "$PROFILE" up -d
+
+# Health check
+for i in $(seq 1 30); do
+    if curl -sf "$HEALTH_URL" > /dev/null 2>&1; then
+        echo "rollback healthy after ${i}s"
+        # Return to main branch (but keep the old deployment)
+        git checkout main 2>/dev/null || true
+        echo "=== ROLLBACK COMPLETE — RUNNING ON $PREVIOUS_SHA ==="
+        exit 0
+    fi
+    sleep 2
+done
+
+echo "ERROR: rollback health check failed"
+exit 1