Document the real webhook root causes (hook secret edits ignored, SHA tip fetch)

AGENTS.md

@@ -56,11 +56,22 @@ what we take vs. skip). Never vendor it into the build.
   so it matches fine. A curl replay needs `X-Gitea-Event: push` and the
   signature header, or it answers "No matching application or invalid
   signature."
-  The app's `manual_webhook_secret_gitea` is **regenerated whenever the app
-  is recreated** — if the Coolify app is ever recreated, update the Gitea
-  hook's secret too (`PATCH /repos/TZGyn/tunnel/hooks/5` with
-  `{"config":{"secret":"<current>"}}`), or real deliveries silently fail
-  signature checks while curl replays still work.
+  Coolify's audit log (MCP `list_audit_events`, `source=webhook`) is the
+  debugging oracle: `webhook.deployment.queued` = authenticated and queued,
+  `webhook.gitea.signature_failed` = the Gitea hook's secret does not match
+  the app's current `manual_webhook_secret_gitea`.
+  **Gitea's hook edit API does not update the stored secret** — PATCHing the
+  hook returns 200 but deliveries keep failing signature checks; delete the
+  hook and create a fresh one with the secret instead (current hook: id 6,
+  branch_filter `main`). The app's secret is regenerated whenever the app is
+  recreated, so recreate the hook after any app recreation.
+  Coolify's webhook deploy pins the pushed commit (`git fetch origin <sha>`),
+  and this Gitea only serves the *current tip* by SHA
+  (`uploadpack.allowReachableSHA1InWant` is off; other SHAs fail with
+  "not our ref"). Deploys fail if a later push lands before the fetch —
+  re-trigger the deploy. Proper fix, inside the Gitea container:
+  `git -C /data/git/repositories/TZGyn/tunnel.git config
+  uploadpack.allowReachableSHA1InWant true`.
   This Coolify version stores `custom_labels` **base64-encoded** and does
   *not* merge its generated Traefik labels for API-created apps: the full
   label set must live in `custom_labels` (mirror a working app's generated