ci: Atomically replace share-svc binary on deploy

scp overwrites in place, which fails with ETXTBSY ("text file busy") on
repeat deploys because systemd is executing /usr/local/bin/share-svc.
Copy to a temp path, chmod, then mv it over the destination so rename(2)
swaps the dir entry without touching the busy inode.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/deploy.yaml

@@ -4,7 +4,10 @@ name: Deploy
 # Caddy host, and restarts the service.
 #
 # Required repo secret:
-#   DEPLOY_SSH_KEY  - private SSH key authorized for ${DEPLOY_USER}@${DEPLOY_HOST}
+#   DEPLOY_SSH_KEY  - base64-encoded private SSH key authorized for
+#                     ${DEPLOY_USER}@${DEPLOY_HOST}. Generate with:
+#                       base64 -w0 < deploy_key      # Linux
+#                       base64 -i deploy_key | tr -d '\n'   # macOS
 #
 # Override host/user/paths via repo variables (Settings > Actions > Variables)
 # if they ever change; the defaults below match the Justfile.
@@ -48,7 +51,10 @@ jobs:
         run: |
           command -v rsync >/dev/null || { apt-get update && apt-get install -y rsync; }
           mkdir -p ~/.ssh && chmod 700 ~/.ssh
-          install -m 600 /dev/stdin ~/.ssh/deploy_key <<< "${{ secrets.DEPLOY_SSH_KEY }}"
+          # DEPLOY_SSH_KEY is stored base64-encoded so the PEM survives the
+          # secret round-trip intact (no CRLF/whitespace/newline mangling).
+          echo "${{ secrets.DEPLOY_SSH_KEY }}" | base64 -d > ~/.ssh/deploy_key
+          chmod 600 ~/.ssh/deploy_key
           ssh-keyscan -H "$DEPLOY_HOST" >> ~/.ssh/known_hosts 2>/dev/null
 
       - name: Copy frontend
@@ -58,8 +64,16 @@ jobs:
 
       - name: Copy backend binary + unit file
         run: |
+          # Copy to a temp path then atomically rename into place. You can't
+          # overwrite a running executable in place (ETXTBSY / "Text file busy"),
+          # but rename(2) just swaps the directory entry while the old inode keeps
+          # serving the running process until the restart step picks up the new
+          # binary. chmod first so the exec bit survives the rename (scp doesn't
+          # preserve mode without -p).
           scp -i ~/.ssh/deploy_key server/share-svc \
-            "$DEPLOY_USER@$DEPLOY_HOST:/usr/local/bin/share-svc"
+            "$DEPLOY_USER@$DEPLOY_HOST:/usr/local/bin/share-svc.new"
+          ssh -i ~/.ssh/deploy_key "$DEPLOY_USER@$DEPLOY_HOST" \
+            'chmod 0755 /usr/local/bin/share-svc.new && mv -f /usr/local/bin/share-svc.new /usr/local/bin/share-svc'
           scp -i ~/.ssh/deploy_key server/share-svc.service \
             "$DEPLOY_USER@$DEPLOY_HOST:/etc/systemd/system/share-svc.service"