#2 Deploy the tip of main, not the webhook's merge_commit_sha

Gogs sets merge_commit_sha to the head branch's commit, not the merge commit, so the first real release deployed 0bfb14e instead of the merge f9f3973. That's harmless when the trees match, but with two PRs branched from the same main, the second release would drop the first PR's changes. deployd now always releases origin/main, and the head commit is logged for reference. test.sh adds the two-PR case (23 checks). README and tests updated.