fix(deploy): source nvm so pnpm is on PATH in non-interactive SSH

The deploy script runs under appleboy/ssh-action which spawns a
non-interactive shell where ~/.bashrc is not read, so the nvm
init that puts node/pnpm on PATH never fires. Source nvm.sh
explicitly at the top of deploy.sh.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

scripts/deploy.sh

@@ -5,6 +5,11 @@ set -euo pipefail
 # Zero-downtime deploy script for sase-v2
 # ──────────────────────────────────────────────
 
+# Load NVM so node/pnpm are on PATH under non-interactive SSH sessions
+export NVM_DIR="$HOME/.nvm"
+# shellcheck disable=SC1091
+[ -s "$NVM_DIR/nvm.sh" ] && . "$NVM_DIR/nvm.sh"
+
 DEPLOY_DIR="$(cd "$(dirname "$0")/.." && pwd)"
 LOG_PREFIX="[deploy]"