ForgeFlow 0.10.10

Complete server-pull deployment repair

Missing repository-scoped read-only deploy keys can be provisioned and verified from Unraid against the exact Gitea branch.
A repository deployment root can now remain above its Compose working directory without breaking workload recognition or being overwritten by inventory refresh.
Nested Compose files are preserved as repository-relative deployment paths, including Ludarium, Launchpad and ITWorx MCP Hub layouts.
The Fix write access action now receives its permission-report parser correctly instead of reporting a false write-access failure.
Server-pull preflight proves every required deployment file at the exact Gitea commit before any container activation starts.
Runtime secrets remain in server-side .env files and preserved appdata paths; no secret values are written to Git or diagnostic output.