ci: add deploy-woodpecker-agent pipeline

The woodpecker-agent role had no deploy pipeline — so the Docker IPv6
daemon.json (PR #48) landed in git but never reached the agents. Mirror
the other deploy-* pipelines: master + manual trigger, runs
install-woodpecker-agent.yml in the ci-ansible runner.

Merging self-triggers on its own path and applies the agent config. It
deploys the agents from an agent, so the Docker restart kills this job
mid-run (reported as failure) but still applies on both agents; re-trigger
deploy-netbird-proxy after.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.woodpecker/deploy-woodpecker-agent.yml

@@ -0,0 +1,43 @@
+when:
+  # Deploy only on master (merge) + manual — never from a feature branch.
+  - event: push
+    branch: master
+    path:
+      - "ansible/roles/woodpecker-agent/**"
+      - "ansible/plays/install-woodpecker-agent.yml"
+      - ".woodpecker/deploy-woodpecker-agent.yml"
+  - event: manual
+    evaluate: 'PIPELINE == "deploy-woodpecker-agent"'
+
+# NOTE: this deploys the agents *from* an agent, so applying a change that
+# restarts Docker (e.g. the daemon.json IPv6 config) will kill this job's own
+# container mid-run — the pipeline reports failure, but the change still
+# applies on both agents (the restart commands are dispatched in parallel
+# before the executing agent's daemon goes down). Re-run / re-trigger
+# deploy-netbird-proxy afterwards.
+timeout: 30
+
+steps:
+  - name: deploy-woodpecker-agent
+    image: gitea.renner.uno/gitea_admin/ci-ansible:2026-04-29
+    environment:
+      ANSIBLE_FORCE_COLOR: "true"
+      ANSIBLE_HOST_KEY_CHECKING: "false"
+      ANSIBLE_ROLES_PATH: "../roles:./roles"
+      SSH_PRIVATE_KEY:
+        from_secret: ssh_private_key
+      VAULT_PASS:
+        from_secret: vault_pass
+      PROXMOX_TOKEN_ID:
+        from_secret: proxmox_token_id
+      PROXMOX_TOKEN_SECRET:
+        from_secret: proxmox_token_secret
+    commands:
+      - mkdir -p ~/.ssh
+      - echo "$SSH_PRIVATE_KEY" | base64 -d > ~/.ssh/id_ed25519
+      - chmod 600 ~/.ssh/id_ed25519
+      - printf "Host *\n\tStrictHostKeyChecking no\n\tUserKnownHostsFile /dev/null\n" > ~/.ssh/config
+      - cd ansible
+      - echo "$VAULT_PASS" > .vault_pass && chmod 600 .vault_pass
+      - export ANSIBLE_VAULT_PASSWORD_FILE=.vault_pass
+      - ansible-playbook -i inventory/ plays/install-woodpecker-agent.yml -v