merge: codex deploy fallback

# Conflicts:
#	AGENTS.md
#	TEST.md
#	config.json
#	deploy.json
#	docs/reference/cli.md
#	docs/reference/microservices.md
#	docs/reference/observability.md
#	scripts/cli.ts
#	scripts/src/microservices.ts
#	src/components/backend-core/src/microservice-proxy.ts
#	src/components/microservices/code-queue/src/index.ts
#	src/components/microservices/code-queue/src/queue-api.ts

src/components/microservices/k3sctl-adapter/k3s/ci/unidesk-ci.pipeline.yaml

@@ -270,6 +270,37 @@ spec:
           shift
           curl -fsS --cacert "$kube_ca" -H "Authorization: Bearer $kube_token" -X "$method" "$@"
         }
+        delete_if_exists() {
+          local path="$1"
+          local code
+          code="$(curl -sS -o /tmp/unidesk-ci-delete-response -w "%{http_code}" --cacert "$kube_ca" -H "Authorization: Bearer $kube_token" -X DELETE "$kube_api/$path")"
+          if [ "$code" = "200" ] || [ "$code" = "202" ] || [ "$code" = "404" ]; then
+            return 0
+          fi
+          cat /tmp/unidesk-ci-delete-response >&2
+          return 1
+        }
+        wait_deleted() {
+          local path="$1"
+          local deadline=$((SECONDS + 120))
+          local code
+          while [ "$SECONDS" -lt "$deadline" ]; do
+            code="$(curl -sS -o /tmp/unidesk-ci-get-response -w "%{http_code}" --cacert "$kube_ca" -H "Authorization: Bearer $kube_token" "$kube_api/$path")"
+            if [ "$code" = "404" ]; then
+              return 0
+            fi
+            if [ "$code" != "200" ]; then
+              cat /tmp/unidesk-ci-get-response >&2
+              return 1
+            fi
+            sleep 2
+          done
+          echo "timeout waiting for $path deletion" >&2
+          return 1
+        }
+        delete_if_exists "apis/apps/v1/namespaces/$kube_namespace/deployments/code-queue-ci-read"
+        delete_if_exists "api/v1/namespaces/$kube_namespace/services/code-queue-ci-read"
+        wait_deleted "apis/apps/v1/namespaces/$kube_namespace/deployments/code-queue-ci-read"
         cat >/tmp/code-queue-ci-read-deployment.yaml <<YAML
         apiVersion: apps/v1
         kind: Deployment
@@ -287,6 +318,8 @@ spec:
             matchLabels:
               app.kubernetes.io/name: code-queue
               app.kubernetes.io/component: ci-read
+          strategy:
+            type: Recreate
           template:
             metadata:
               labels:
@@ -382,6 +415,13 @@ spec:
                     periodSeconds: 5
                     timeoutSeconds: 3
                     failureThreshold: 20
+                  startupProbe:
+                    httpGet:
+                      path: /live
+                      port: http
+                    periodSeconds: 5
+                    timeoutSeconds: 3
+                    failureThreshold: 84
                   livenessProbe:
                     httpGet:
                       path: /live
@@ -396,11 +436,17 @@ spec:
                     limits:
                       memory: 1Gi
                   volumeMounts:
+                    - name: source
+                      mountPath: /app
                     - name: state
                       mountPath: /var/lib/unidesk/code-queue-ci
                     - name: logs
                       mountPath: /var/log/unidesk
               volumes:
+                - name: source
+                  hostPath:
+                    path: "$(workspaces.source.path)/repo"
+                    type: Directory
                 - name: state
                   emptyDir: {}
                 - name: logs
@@ -434,7 +480,7 @@ spec:
           -H "Content-Type: application/apply-patch+yaml" \
           --data-binary @/tmp/code-queue-ci-read-01 \
           "$kube_api/api/v1/namespaces/$kube_namespace/services/code-queue-ci-read?fieldManager=unidesk-ci&force=true" >/dev/null
-        deadline=$((SECONDS + 180))
+        deadline=$((SECONDS + 420))
         while [ "$SECONDS" -lt "$deadline" ]; do
           status="$(kube GET "$kube_api/apis/apps/v1/namespaces/$kube_namespace/deployments/code-queue-ci-read")"
           replicas="$(printf '%s' "$status" | jq -r '.spec.replicas // 1')"