ci(gitea): allow dirty-node safe mode before hard phase6 gate

.gitea/workflows/deploy-node1-runtime.yml

@@ -100,9 +100,13 @@ jobs:
             "${SSH_USER}@${SSH_HOST}" \
             "set -euo pipefail; \
              cd /opt/microdao-daarion; \
-             git fetch origin; \
-             git checkout '${DEPLOY_REF:-main}'; \
-             git pull --ff-only origin '${DEPLOY_REF:-main}'; \
+             if [ -n \"\$(git status --porcelain)\" ]; then \
+               echo 'WARN: dirty git tree on NODA1; skip checkout/pull and continue with gate'; \
+             else \
+               git fetch origin; \
+               git checkout '${DEPLOY_REF:-main}'; \
+               git pull --ff-only origin '${DEPLOY_REF:-main}'; \
+             fi; \
              if [ '${REDEPLOY_RUNTIME:-false}' = 'true' ]; then \
                docker compose -f docker-compose.node1.yml up -d --no-deps --build --force-recreate gateway experience-learner; \
              fi; \

docs/ops/deploy_gate.md

@@ -31,6 +31,7 @@ Required repo secrets:
 
 - `redeploy_runtime=false` only syncs git on NODA1 and runs gate checks.
 - `redeploy_runtime=true` recreates `gateway` and `experience-learner` containers.
+- If NODA1 git tree is dirty, workflow skips checkout/pull and still enforces `phase6_gate` (safe mode for live nodes).
 - Workflow uses SSH key validation and `IdentitiesOnly=yes` to avoid host key collisions.
 
 ## Expected PASS