fix(agentgit): make git push over SSH work on :2222

[ralyodio]

Problem

git push over SSH to git.profullstack.com has never worked. The API advertises ssh://git@git.profullstack.com:2222/..., but :2222 times out from outside, and even with the port open the built-in server refuses git@.

Changes (setup.sh §9d)

• BUILTIN_SSH_SERVER_USER = git: SSH_USER only changes the advertised clone URL; the built-in server accepts BUILTIN_SSH_SERVER_USER (default RUN_USER forgejo) and logs "Invalid SSH username git - must use forgejo". app.ini is written once, so besides the template, every run now converges the SSH keys of [server] in the existing app.ini (awk, idempotent, numbered app.bak-NNN.ini backup the first time). Forgejo is restarted every run already.
• Forgejo upgrade never applied: the download curl'd onto the running /usr/local/bin/forgejo → ETXTBSY. Every deploy log shows forgejo download failed, and prod is still 11.0.1 against the 11.0.15 pin. Now: download to forgejo.new, check --version, mv (same as deploy/git-chovy/install.sh). This deploy will upgrade AgentGit 11.0.1 → 11.0.15 (same LTS line).
• ufw: ufw allow 2222/tcp >/dev/null 2>&1 || true swallowed any failure; now it warns. The run logs whether :2222 is listening (ss) and the ufw rule, because the box has no shell and the deploy log is the only window.

Changes (deploy.yml)

• A report-only step probes 2222 / 563 / 6697 from the runner. Evidence so far points at a DigitalOcean Cloud Firewall: :563 (NNTPS, also ufw-allowed by setup.sh) and :2222 both time out, while :587 is refused (reached the host). docs/irc.md already records that 6697 had to be added to the cloud firewall by hand. No DO token exists in the vault, so that layer cannot be changed from CI.
• The closing setup.sh reminder now lists every public port the cloud firewall needs.

Test

• bash -n, shellcheck (-S warning: same single pre-existing SC2097 as main)
• the app.ini converge function run against a copy of the prod template: adds exactly one line, second run is a no-op, missing [server] and end-of-file cases handled

🤖 Generated with Claude Code

[github-actions]

ThreatCrush Security Scan

10 finding(s)

HIGH/CRITICAL: 7 | LOW: 3

Severity	Rule	Location
HIGH	secret-generic-credential	deploy/ergo/ircd.yaml:162
HIGH	secret-generic-credential	deploy/ergo/ircd.yaml:221
HIGH	secret-generic-credential	deploy/ergo/ircd.yaml:638
HIGH	secret-generic-credential	deploy/ergo/ircd.yaml:787
HIGH	secret-database-url	deploy/ergo/ircd.yaml:893
HIGH	secret-generic-credential	deploy/ergo/ircd.yaml:1025
HIGH	secret-generic-credential	deploy/ergo/ircd.yaml:1033
LOW	secret-generic-credential	deploy/ergo/ircd.yaml:772
LOW	tls-verification-disabled	internal/mail/mail.go:109
LOW	secret-generic-credential	internal/mailu/mailu_test.go:44

Snippets are redacted; ThreatCrush never prints matched credential material.

[ralyodio]

Closing unmerged: root cause is a DigitalOcean cloud firewall in front of the droplet (verified on-box: app.ini already has BUILTIN_SSH_SERVER_USER = git, ufw allows 2222, forgejo listens on *:2222, nft accept counter never moves for outside connects). No setup.sh change needed for :2222.