Resolve main explicitly and schedule auto-deploy on the calendar (Maestro 85cca5ad)

F24-1: resolve refs/remotes/origin/main^{commit} instead of the ambiguous
origin/main, which a tag or local branch of that name would shadow.

F24-2: the timer fires on OnCalendar=*-*-* *:0/15:00 so Persistent=true
catches up a check missed while the host was down; the runbook documents
the new schedule.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

deploy/systemd/mealquest-auto-deploy.timer

@@ -1,15 +1,11 @@
-# Checks for a new main every 15 minutes (plus up to 5 minutes' random
-# delay), starting 2 minutes after the timer starts. OnUnitActiveSec= alone
-# never fires before the service's first run, so OnActiveSec= starts the
-# cycle at boot and at `enable --now`. Persistent= is set as the task
-# specified; systemd applies it only to OnCalendar= triggers, so with these
-# monotonic triggers it has no effect.
+# Checks for a new main at every quarter hour (plus up to 5 minutes' random
+# delay). Persistent= runs a check at once when the host comes back if a
+# scheduled one was missed while it was down.
 [Unit]
 Description=Periodic MealQuest automated deploy
 
 [Timer]
-OnActiveSec=2min
-OnUnitActiveSec=15min
+OnCalendar=*-*-* *:0/15:00
 RandomizedDelaySec=5min
 Persistent=true