fix(deploy): prevent git fetch failure for checked-out branches

The worktree update path ran `git fetch origin "$BRANCH"` which,
due to the bare repo's refspec (+refs/heads/*:refs/heads/*), tried
to update the local branch ref. Git refuses this when the branch is
checked out in a worktree, breaking main deployments on every push.

Add --refmap="" to suppress the configured refspec so only FETCH_HEAD
is updated. The subsequent `git reset --hard FETCH_HEAD` works as
originally intended.

Author: danielnaab

infrastructure/nixos/modules/deploy.nix

@@ -113,8 +113,11 @@ let
       echo "Updating worktree for $BRANCH..."
       cd "$BRANCH_DIR"
       # Fetch directly in the worktree — can't update the bare repo ref while
-      # the branch is checked out, so use FETCH_HEAD + reset instead
-      ${pkgs.git}/bin/git fetch origin "$BRANCH"
+      # the branch is checked out, so use FETCH_HEAD + reset instead.
+      # --refmap="" suppresses the bare repo's configured refspec
+      # (+refs/heads/*:refs/heads/*) which would try to update the local
+      # branch ref and fail for checked-out branches.
+      ${pkgs.git}/bin/git fetch origin --refmap="" "refs/heads/$BRANCH"
       ${pkgs.git}/bin/git reset --hard FETCH_HEAD
     fi