Push-to-deploy (OFF by default): vanguard-deploy applies only changed parts with a live-stream guard for MediaMTX, rollback, pending timer; dumpd /deploy webhook gated by DEPLOY_AUTO; configure --apply; switchToClone.sh; draft CI workflow; committed plugin zip

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

systemd/deploy-pending.service

@@ -0,0 +1,7 @@
+[Unit]
+Description=Restart MediaMTX if a deploy deferred it and no stream is live
+After=docker.service
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/bin/vanguard-deploy pending

systemd/deploy-pending.timer

@@ -0,0 +1,9 @@
+[Unit]
+Description=Retry deferred MediaMTX restart every 5 minutes
+
+[Timer]
+OnBootSec=3min
+OnUnitActiveSec=5min
+
+[Install]
+WantedBy=timers.target