fix: pin Tasker deploy runner compose project

infra/synology/README.md

@@ -10,6 +10,29 @@
 - Внутренний HTTP edge использует `18080`, AI Workspace Hub — `18081`, Tasker upstream — `18090`, BIM Viewer upstream — `18100`, Ops Agents Gateway upstream — `18190`.
 - Старые порты `9000` и `5678` заняты старым `nodedc-demo` и не используются.
 
+## Deploy runner
+
+`nodedc-deploy` is managed outside the platform runtime tree. The synced install candidate lives in:
+
+```text
+/volume1/docker/nodedc-deploy/runner-install/nodedc-deploy
+```
+
+The live root-owned runner is:
+
+```text
+/usr/local/sbin/nodedc-deploy
+```
+
+`deploy-current.sh` syncs the runner candidate into `runner-install`. Promoting it to live is explicit:
+
+```bash
+sudo install -o root -g root -m 0755 \
+  /volume1/docker/nodedc-deploy/runner-install/nodedc-deploy \
+  /usr/local/sbin/nodedc-deploy
+sudo /usr/local/sbin/nodedc-deploy verify-install
+```
+
 ## Текущие внешние домены
 
 ```text

infra/synology/deploy-current.sh

@@ -4,6 +4,7 @@ set -euo pipefail
 SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
 PLATFORM_REPO="$(cd -- "${SCRIPT_DIR}/../.." && pwd)"
 NAS_ROOT="${NAS_ROOT:-/Volumes/docker/nodedc-platform}"
+DEPLOY_ROOT="${DEPLOY_ROOT:-$(cd -- "${NAS_ROOT}/.." && pwd)/nodedc-deploy}"
 LAUNCHER_REPO="${LAUNCHER_REPO:-}"
 TASKER_REPO="${TASKER_REPO:-}"
 TASKER_SYNC_SOURCE="${TASKER_SYNC_SOURCE:-0}"
@@ -45,6 +46,12 @@ rsync -av "${RSYNC_METADATA_ARGS[@]}" \
   "${PLATFORM_REPO}/infra/synology/clear-authentik-brand-css.sh" \
   "${NAS_ROOT}/platform/"
 
+mkdir -p "${DEPLOY_ROOT}/runner-install"
+rsync -av "${RSYNC_METADATA_ARGS[@]}" \
+  "${PLATFORM_REPO}/infra/deploy-runner/nodedc-deploy" \
+  "${DEPLOY_ROOT}/runner-install/nodedc-deploy"
+chmod 0755 "${DEPLOY_ROOT}/runner-install/nodedc-deploy"
+
 mkdir -p "${NAS_ROOT}/platform/notification-core"
 rsync -av "${RSYNC_METADATA_ARGS[@]}" --delete \
   --exclude='node_modules/' \