CI only builds/tests. Deploy is a separate workflow triggered via workflow_run after CI passes: pull → bun install → web build → restart all 4 systemd services (web/api/mcp/worker) over SSH. Secrets (stored in GitHub): - SSH_DEPLOY_HOST=100.79.111.61 - SSH_DEPLOY_PORT=22 - SSH_DEPLOY_USER=code - SSH_DEPLOY_KEY=<ed25519 deploy key added to VPS authorized_keys>