Push-to-deploy (OFF by default): vanguard-deploy applies only changed parts with a live-stream guard for MediaMTX, rollback, pending timer; dumpd /deploy webhook gated by DEPLOY_AUTO; configure --apply; switchToClone.sh; draft CI workflow; committed plugin zip

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

install.sh

@@ -7,7 +7,7 @@ OWNER="${SUDO_USER:-debian}"      # the login user; owns /srv/media and may run
 
 echo "== packages"
 apt-get update -q
-apt-get install -y -q ca-certificates curl gnupg ffmpeg jq psmisc rclone python3 xfsprogs
+apt-get install -y -q ca-certificates curl gnupg ffmpeg jq psmisc rclone python3 python3-yaml xfsprogs git nodejs npm rsync
 
 if ! command -v docker >/dev/null; then
   echo "== docker"