Polish GeoIntel workbench and harden Tower deploy

scripts/deploy_tower.sh

@@ -4,8 +4,8 @@ set -euo pipefail
 REMOTE_HOST="${REMOTE_HOST:-root@192.168.10.150}"
 REMOTE_PATH="${REMOTE_PATH:-/mnt/user/appdata/geointel}"
 REMOTE_BRANCH="${REMOTE_BRANCH:-main}"
-REMOTE_REPO="${REMOTE_REPO:-gitea-widefrog:NuklearRabbit/geointel.git}"
-SSH_KEY="${SSH_KEY:-$HOME/.ssh/widefrog_unraid_deploy}"
+REMOTE_REPO="${REMOTE_REPO:-git@gitea.itworx.tech:Jens/geointel.git}"
+SSH_KEY="${SSH_KEY:-$HOME/.ssh/itworx_unraid_deploy}"
 FRONTEND_URL="${FRONTEND_URL:-http://192.168.10.150:1202}"
 BOOTSTRAP="${DEPLOY_BOOTSTRAP:-0}"
 DEPLOY_GEOINTEL_INSTALL_AI="${GEOINTEL_INSTALL_AI:-}"
@@ -20,6 +20,7 @@ ssh "${ssh_opts[@]}" "$REMOTE_HOST" \
 set -euo pipefail
 
 cd "$REMOTE_PATH"
+git config --global --add safe.directory "$REMOTE_PATH"
 
 if [[ ! -d .git ]]; then
   if [[ "$DEPLOY_BOOTSTRAP" != "1" ]]; then
@@ -33,6 +34,10 @@ fi
 
 git fetch origin "$REMOTE_BRANCH"
 git checkout -B "$REMOTE_BRANCH" "origin/$REMOTE_BRANCH"
+# Remove only untracked source files that can enter the image. Persistent
+# runtime roots (.env, storage, models and postgres-data) are deliberately not
+# in this scoped clean list.
+git clean -fd -- backend frontend deploy scripts fixtures tests contracts demo
 chmod +x scripts/*.sh backend/docker_start.sh deploy/unraid/*.sh || true
 
 FRONTEND_URL="$FRONTEND_URL" \