fix(ops): deploy waits for a running SSG rebuild; gate ignores ssg-worker content state

[mrviduus]

What broke (2026-10-04)

• SSG rebuilds queued by two backup test runs were rendering into dist/ssg-new while the fix(security): assistant credential scope, per-client rate-limit keys #693 and chore: delete podcast feature #692 deploys ran Build frontend, which empties apps/web/dist. The 2026-08-31 guard (assertBuildSurvived) correctly failed those jobs instead of promoting a half tree → lastRunFailed: true, health check red.
• ssg-worker's healthcheck reports unhealthy when its last job failed. fix(ops): real API health check, pipefail backups, disk alarm, isolated claude CLI #691's new post-deploy gate (fail on any unhealthy service) then failed the chore: delete podcast feature #692 deploy on it — although every container was up and prod healthy. Containers and the DropPodcast migration had already been applied.
• Any rebuild source can hit this — nightly, publish, admin button, periodic safety net — whenever a merge lands mid-render.

Fix

• New step before the SSG snapshot / frontend build: wait while an SSG job is Queued/Running (max 40 min, then proceed with a warning). Only jobs started/created in the last hour count — a row left Running by a crash (nothing recovers those; one exists locally) must not cost every deploy 40 min.
• Health gate excludes ssg-worker: its "last rebuild failed" is content state, alarmed by health-check.yml, not a broken deploy.

Verified

• action-validator ok; the SQL runs against the local DB (textstack_prod, status stored as text).

After merge

Queue one clean full rebuild with nothing deploying → lastRunFailed resets, health check green.

Rollback

Revert.

🤖 Generated with Claude Code