Verify the deploy actually came up, not just that it was launched

systemctl restart (Type=simple, no readiness protocol) returns as
soon as podman compose up --build forks, before the build or the
container start have actually finished - a build failure or crash
loop would still show as a green deploy job. Poll /api/health for up
to 5 minutes (comfortably above the ~3.5min worst-case cold rebuild)
and fail the job if it never answers.

.gitea/workflows/ci.yml

@@ -109,3 +109,22 @@ jobs:
       # (gitea-runner has passwordless sudo for this on cube-host).
       - name: Deploy
         run: sudo systemctl restart podman-compose@maptool.service
+
+      # systemctl restart above only confirms the process forked
+      # (Type=simple, no readiness protocol) — not that `podman compose up
+      # --build` actually finished and Puma is answering. Polls the health
+      # endpoint (cube-host itself, same machine the container's port is
+      # published on) instead of trusting that. 5 minutes covers even a
+      # from-scratch rebuild (Gemfile change, ~3.5 minutes measured) with
+      # room to spare; a cached rebuild is normally up within a minute.
+      - name: Wait for it to come up
+        run: |
+          for i in $(seq 1 30); do
+            if curl -sf http://localhost:4567/api/health >/dev/null; then
+              echo "Healthy after $(( (i - 1) * 10 ))s"
+              exit 0
+            fi
+            sleep 10
+          done
+          echo "::error::maptool did not become healthy within 5 minutes"
+          exit 1