provisioning: stop deleting the pre-rename hook and subscription

Retiring gitea-events is a one-off migration, not something worth re-running
on every boot. Both units now only touch what they own: jupiter's creates or
updates its own hook and deletes nothing, and mars's removes only the route
it is about to re-subscribe, as the idempotency step for `subscribe`.

Keeping the deletes would have meant a redeploy could silently remove a hook
or route someone added deliberately -- a real risk now that sibling hooks
for other Hermes routes are the intended pattern.

README carries the manual commands, and the note that both hooks fire until
the old one is removed by hand, so events arrive twice in the meantime.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01S94o42aQ8VkBmEWvDem5xa

services/dev/gitea-hermes-webhook-relay.nix

@@ -138,11 +138,10 @@ in
         sleep 1
       done
 
-      # gitea-events is the old name of this route (renamed to say what it
-      # actually handles); removing it keeps a redeployed host from serving
-      # both. The second remove is the idempotency step for the subscribe
-      # below, not cleanup.
-      podman exec hermes-agent hermes webhook remove gitea-events >/dev/null 2>&1 || true
+      # Idempotency for the subscribe below, not cleanup: this removes only
+      # the route this unit owns. The pre-rename gitea-events subscription is
+      # left alone — retiring it is a one-off migration done by hand, so that
+      # a redeploy never silently deletes a route someone added on purpose.
       podman exec hermes-agent hermes webhook remove gitea-pr-comments >/dev/null 2>&1 || true
       # `set -eu` inside the container shell is load-bearing: without it a
       # missing prompt file makes `cat` fail, the command substitution yields

services/dev/gitea.nix

@@ -338,11 +338,10 @@ in
       relay="http://mars.orbit.sol:8645"
       target="$relay/gitea/gitea-pr-comments"
 
-      # Retire the pre-rename hook, which posted to the relay's bare path and
-      # would now double-deliver alongside $target. Matched by its EXACT old
-      # URL, deliberately: anything else pointing at $relay is a hook for a
-      # different Hermes route and must survive.
-      legacy_target="$relay/gitea"
+      # This unit only ever creates or updates $target. It deliberately does
+      # NOT delete anything, including the pre-rename hook on the relay's bare
+      # path — that is a one-off migration, done by hand, not a thing this
+      # runs on every boot. See the README for the command.
 
       # Same readiness gate as gitea-ci-bot-provision / gitea-luna-provision
       # above: After=gitea.service only means the process started, not that it
@@ -361,14 +360,7 @@ in
         --argjson events '${builtins.toJSON giteaWebhookEvents}' \
         '{type: "gitea", config: {content_type: "json", url: $url, secret: $secret}, events: $events, active: true}')"
 
-      hooks="$(curl -fsS "''${auth[@]}" "$api/repos/darman/homelab/hooks")"
-
-      for stale in $(printf '%s' "$hooks" \
-        | jq -r --arg url "$legacy_target" '.[] | select(.type == "gitea" and .config.url == $url) | .id'); do
-        curl -fsS "''${auth[@]}" -X DELETE "$api/repos/darman/homelab/hooks/$stale" >/dev/null
-      done
-
-      hook_id="$(printf '%s' "$hooks" \
+      hook_id="$(curl -fsS "''${auth[@]}" "$api/repos/darman/homelab/hooks" \
         | jq -r --arg url "$target" 'first(.[] | select(.type == "gitea" and .config.url == $url)) | .id // empty')"
       if [ -n "$hook_id" ]; then
         printf '%s' "$body" | curl -fsS "''${auth[@]}" -H 'Content-Type: application/json' \