checkpoint: multi-repo Gitea ingestion, per-project repos, rotation anchor_sha fix

Pre-existing uncommitted work found at session start: rotation now emits
anchor_sha on TaskReleased (previously silently dropped by store.Append
validation), multi-repo Gitea provider support, per-project git worktree
roots, and associated test coverage. Committing as a checkpoint before
starting remediation work tracked in AUDIT.md.

deploy/redeploy.sh

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+repo_dir="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)"
+tmp_bin="$(mktemp)"
+trap 'rm -f -- "$tmp_bin"' EXIT
+
+cd "$repo_dir"
+echo "Building Orchestra..."
+go build -o "$tmp_bin" ./cmd/orchestra
+
+echo "Installing /usr/local/bin/orchestra..."
+sudo install -o root -g root -m 0755 "$tmp_bin" /usr/local/bin/orchestra
+
+echo "Restarting orchestra.service..."
+sudo systemctl restart orchestra.service
+sudo systemctl --no-pager --lines=8 status orchestra.service