fix(deploy): push-workers.sh chowns + preserves .env

Rsync ran as root over SSH so files landed root-owned, but workers run
as voidworkers — the service couldn't even reach the venv binary.
Now: chown -R voidworkers after rsync, run venv create + pip install
under `su voidworkers -c`. Also excludes .env, .gitignore, .pytest_cache
so they survive across deploys.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

deploy/push-workers.sh

@@ -12,16 +12,23 @@ rsync -avz --delete \
   --exclude __pycache__ \
   --exclude '*.egg-info' \
   --exclude tests \
+  --exclude .env \
+  --exclude .gitignore \
+  --exclude .pytest_cache \
   workers/ "$TARGET:$REMOTE_DIR/"
 
 ssh "$TARGET" "
-  cd $REMOTE_DIR
+  # rsync runs as root → files land root-owned. Workers run as voidworkers.
-  if [ ! -d venv ]; then
+  chown -R voidworkers: $REMOTE_DIR
-    python3.12 -m venv venv
+  su voidworkers -c '
-  fi
+    cd $REMOTE_DIR
-  . venv/bin/activate
+    if [ ! -d venv ]; then
-  pip install --quiet --upgrade pip
+      python3 -m venv venv
-  pip install --quiet -e '.[all]'
+    fi
+    . venv/bin/activate
+    pip install --quiet --upgrade pip
+    pip install --quiet -e \".[all]\"
+  '
   systemctl restart void-workers
 "
 echo "Workers deployed."