fix(cinny-deploy): queue a trigger that arrives mid-deploy instead of dropping it

lotus_deploy.sh took an flock and exited if a deploy was already running.
The poll loop only retargets origin/lotus while it is still waiting on
CI; a push that lands during npm ci / npm run build was silently never
deployed until the next unrelated push (cinny 81a6d9c9 — the MSC4515
call fix — passed CI but never reached the web root). A concurrent
trigger now leaves a .pending marker and the running deploy re-execs
itself once at the end, which re-fetches and re-gates on CI as usual.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA

cinny/lotus_deploy.sh

@@ -6,9 +6,20 @@ WEBROOT="/var/www/html"
 LOCKFILE="/tmp/lotus-deploy.lock"
 LOGFILE="/var/log/lotus-deploy.log"
 
-# Prevent concurrent deploys
+# Prevent concurrent deploys. A trigger that arrives while a deploy holds the
+# lock is NOT dropped any more: it leaves a marker, and the running deploy
+# re-runs itself once when it finishes. (Previously it was skipped outright —
+# the poll loop retargets origin/lotus only while it is still polling, so a
+# push that landed during `npm ci && npm run build` was never deployed until
+# the next unrelated push. Bit us on cinny 81a6d9c9.)
+PENDING="$LOCKFILE.pending"
 exec 200>"$LOCKFILE"
-flock -n 200 || { echo "[$(date '+%Y-%m-%d %H:%M:%S')] Deploy already in progress, skipping." >> "$LOGFILE"; exit 0; }
+if ! flock -n 200; then
+    touch "$PENDING"
+    echo "[$(date '+%Y-%m-%d %H:%M:%S')] Deploy already in progress — queued a follow-up run." >> "$LOGFILE"
+    exit 0
+fi
+rm -f "$PENDING"
 
 exec >> "$LOGFILE" 2>&1
 echo "[$(date '+%Y-%m-%d %H:%M:%S')] ===== Deploy triggered ====="
@@ -153,6 +164,15 @@ rsync -a --delete --exclude config.json dist/ "$WEBROOT/"
 
 echo "[$(date '+%Y-%m-%d %H:%M:%S')] ===== Deploy complete ($VITE_APP_VERSION) ====="
 
+# A trigger arrived while we were deploying: release the lock and run once more
+# so the newest origin/lotus gets deployed (it re-fetches and re-gates on CI).
+if [ -f "$PENDING" ]; then
+    rm -f "$PENDING"
+    echo "[$(date '+%Y-%m-%d %H:%M:%S')] Queued trigger found — re-running deploy for the newest commit."
+    flock -u 200
+    exec "$0" "$@"
+fi
+
 # Inject runtime secrets that are never stored in git. If the production
 # config.json carries the "gifApiKey": "" placeholder, fill it from the env.
 if [ -n "${GIPHY_API_KEY:-}" ]; then