docs(hrafn-ci): mirror the now-canonical vh/hrafn pipeline; record two failed runs

claude-bot holds write on vh/hrafn as of 2026-08-23, so the canonical copy of
the pipeline moved there and infra-ops maintains it directly instead of
routing patches through the repo holder. The files here are a verified mirror
(byte-identical to live at 22e0eb9d75a6).

Live state: run 9922 green, and both new content assertions executed rather
than merely existing --

  verify 4/5  host tree matches shipped context (a99ce748a0c9...)
  verify 5/5  image source matches host source (06f209fd0641...)

The CI-computed context hash matching on the host is the end-to-end proof
that the converge lands what CI ships. Its absence is what let the
frozen-source bug survive every green deploy.

Also records why the HEAD == GITHUB_SHA assertion was added and then removed:
it needed the git binary (run 9920, exit 127), and installing git flipped
actions/checkout@v4 from its node implementation to the git binary, which
died on a missing CA bundle (run 9921). A nice-to-have assertion changed the
checkout code path and broke a working pipeline; it guarded a hypothesis that
proved wrong, so it went rather than getting ca-certificates bolted on.

stacks/hrafn/ci/README.md

@@ -1,18 +1,24 @@
-# hrafn CI deploy — authored here, lands in `vh/hrafn`
+# hrafn CI deploy — mirror of what runs in `vh/hrafn`
 
-These two files replace hrafn's hand-rsync deploy. They are **authored and
-version-controlled here** because infra-ops owns hrafn's uptime, but they
-**belong in the `vh/hrafn` repo** — infra-ops has no write access to it
-(claude-bot is not a collaborator), so they are handed to the repo holder
-rather than committed directly.
+These two files are hrafn's deploy pipeline. The **canonical copy now lives in
+`vh/hrafn`** — as of 2026-08-23 claude-bot holds `write` there, so infra-ops
+maintains the pipeline it owns directly instead of routing patches through the
+repo holder.
 
-| file here | destination in `vh/hrafn` |
+| file here | canonical location in `vh/hrafn` |
 |---|---|
 | `playbooks-deploy.yaml` | `playbooks/deploy.yaml` |
 | `gitea-workflows-deploy.yaml` | `.gitea/workflows/deploy.yaml` |
 
-Keep this copy in sync if the deployed version changes, or delete it once
-infra-ops has write access to `vh/hrafn` and the repo copy is canonical.
+This copy is a **mirror kept for review and history**, verified byte-identical
+to the live files at commit `22e0eb9d75a6`. If you change one, change both —
+or check with:
+
+```bash
+curl -s "https://gitea.phasefinal.com/api/v1/repos/vh/hrafn/contents/playbooks/deploy.yaml?ref=main" \
+  -H "Authorization: token $(cat ~/.config/claude-bot/gitea-token-repo-create)" \
+  | python3 -c 'import json,sys,base64,hashlib; print(hashlib.sha256(base64.b64decode(json.load(sys.stdin)["content"])).hexdigest()[:12])'
+```
 
 ## What the change buys
 
@@ -98,6 +104,29 @@ and `__pycache__` appears at runtime, so a naive `find src -type f` compare
 fails on every healthy deploy. Verified against a known-good container
 before shipping: 12 host files, 18 in the container, 0 content differences.
 
+## Two failed runs getting there (9920, 9921)
+
+Worth reading before adding anything to the workflow's prerequisite step.
+
+The frozen-source fix originally shipped with a `HEAD == GITHUB_SHA`
+assertion. It failed twice, both times for reasons the change itself
+introduced:
+
+- **run 9920** — `git: command not found` (exit 127). act_runner's job image
+  ships no git binary, and `actions/checkout@v4` does not need one.
+- **run 9921** — adding `git` made the checkout fail with `server certificate
+  verification failed. CAfile: none`. Installing git flips checkout@v4 from
+  its **node implementation** — which every working run of this pipeline had
+  used — to the **git binary**, and the image has no CA bundle.
+
+So a nice-to-have assertion changed the checkout's code path and broke a
+working pipeline. It was removed rather than patched with `ca-certificates`:
+it guarded a hypothesis that turned out to be **wrong** (the frozen source was
+a self-referential rsync in the playbook, not a stale checkout), and
+`clean: true` plus the host-side content hash already cover the real risk.
+
+**Do not add `git` to the prerequisite step.** Run 9922 is green with it out.
+
 ## Validation
 
 The playbook parses and interpolates clean under elway's own parser: