build(selfhost): make host deploys Git-backed and image-ready

[JSONbored]

Summary

Make the self-hosted maintainer deployment Git-backed now, while keeping official images/packages deferred until the remaining self-host issues are verified.

Context

The current maintainer stack needs a clean, repeatable path for pulling upstream changes without overwriting local runtime state. The near-term target is a normal checkout of origin/main plus local-only deploy overrides. The later target is an official image/package flow once the stack has passed the remaining functional and operational checks.

Requirements

• Keep runtime secrets, repo-specific config, persisted data, runner state, Claude skills, and CLAUDE.md/AGENTS.md intact.
• Keep local deploy overrides out of Git while allowing upstream source files to fast-forward cleanly.
• Preserve local-only settings needed for the maintainer stack, including subscription CLI support, localhost-only bindings, and Grafana dashboard support.
• Make future updates use a clear git fetch/fast-forward/rebuild flow from origin/main.
• Do not publish official images/packages as part of this issue.

Deliverables

• Current host deployment is a clean checkout tracking origin/main.
• Local-only deploy overrides are documented or isolated so they do not dirty the checkout.
• A rollback snapshot exists before the Git conversion.
• The stack is rebuilt from the clean checkout and verified healthy.
• A follow-up image/package issue remains separate for the official distribution path.

Acceptance criteria

• git status is clean after excluding local-only runtime files.
• Compose config validates with the local override present.
• The app readiness endpoint passes after rebuild.
• Claude Code and Codex CLI binaries are available inside the local image when the AI CLI build arg is enabled.
• Codex auth storage remains mounted/preserved.
• No runtime secrets or custom repo configuration are committed or overwritten.