playbooks/deploy-task-board: accept SHA refs, not just branches

CI passes --var ref=<github.sha> (a full SHA), but the playbook
hardcoded `git reset --hard origin/{{ ref }}` which only works for
branch names — `origin/<sha>` is invalid syntax. Resolve ref via
git rev-parse with `^{commit}` (try origin/<ref> first for branch
names, fall back to bare <ref> for SHAs/tags) so manual runs (ref=main)
and CI runs (ref=<sha>) both work.

Same fix applied to the changed_when comparison so no-op reruns still
report ok instead of changed.

playbooks/deploy-task-board.yaml

@@ -50,11 +50,20 @@ steps:
   - name: Fetch from origin
     shell: cd {{ build_dir }} && git fetch --quiet origin
 
-  - name: Reset working tree to origin/{{ ref }}
-    shell: cd {{ build_dir }} && git reset --hard origin/{{ ref }}
+  - name: Reset working tree to {{ ref }}
+    # Accept either a branch name (resolves via origin/<ref>) or a
+    # full/short SHA (resolves directly). CI passes the triggering
+    # commit SHA via --var ref=${{ github.sha }}; manual runs pass
+    # branch names like main / v0.1.0.
+    shell: |
+      cd {{ build_dir }}
+      if sha=$(git rev-parse --verify --quiet "origin/{{ ref }}^{commit}"); then :;
+      elif sha=$(git rev-parse --verify --quiet "{{ ref }}^{commit}"); then :;
+      else echo "elway: ref not found: {{ ref }}" >&2; exit 1; fi
+      git reset --hard "$sha"
     # Report ok (no-change) when the tree was already at the requested
     # ref — saves a noisy CHANGED status line on no-op reruns.
-    changed_when: '[ "$(cd {{ build_dir }} && git rev-parse HEAD 2>/dev/null)" != "$(cd {{ build_dir }} && git rev-parse origin/{{ ref }} 2>/dev/null)" ]'
+    changed_when: '[ "$(cd {{ build_dir }} && git rev-parse HEAD)" != "$(cd {{ build_dir }} && (git rev-parse --verify --quiet "origin/{{ ref }}^{commit}" || git rev-parse --verify --quiet "{{ ref }}^{commit}"))" ]'
 
   # ── image build ─────────────────────────────────────────────────────
   - name: Build image {{ image_tag }}