deploy.sh: drop page caches before restart; headless sudo; ssh-based health check

Deterministic deployment instead of agent ritual:

- DROP_CACHES per target (dankclaw=1): runs 'sync; echo 3 >
  /proc/sys/vm/drop_caches' before systemctl restart. Without it the
  model load stalls at 28 GiB VRAM when the model pages are cached.
- FRANK_SUDO_PW env var: remote sudo pipes it via 'sudo -S' so the
  script runs headless. Falls back to plain sudo otherwise.
- Health check runs curl on the target over ssh (127.0.0.1:7770 was
  previously checked from the workstation, which can never see it).

docs/deployment.md

@@ -59,18 +59,22 @@ The script does these actions:
 2. Pushes the `main` branch to origin.
 3. Pulls the repository on the target machine.
 4. Installs or updates the systemd unit.
-5. Reloads systemd and restarts the service.
-6. Waits for the health endpoint to respond.
+5. Drops page caches on Dankclaw before the restart. This prevents the load stall that happens when the model's pages are fully cached.
+6. Reloads systemd and restarts the service.
+7. Waits for the health endpoint to respond (over ssh).
 
-## Manual Update
+Set `FRANK_SUDO_PW` when running headless, so that remote sudo reads the password from stdin:
 
-If you cannot run the deploy script, update a server manually. Complete each step on the target machine.
+```
+FRANK_SUDO_PW=... ./scripts/deploy.sh dankclaw
+```
 
 ### Update Dankclaw
 
 1. Pull the repository.
 2. Symlink the unit file, if it changed.
-3. Reload and restart the service.
+3. Drop the page caches.
+4. Reload and restart the service.
 
 Run these commands on Dankclaw:
 
@@ -78,6 +82,7 @@ Run these commands on Dankclaw:
 cd /home/dank/vllmScripts
 git pull origin main
 sudo ln -sf /home/dank/vllmScripts/scripts/frank-default-large.service /etc/systemd/system/frank-default-large.service
+sync && echo 3 | sudo tee /proc/sys/vm/drop_caches
 sudo systemctl daemon-reload
 sudo systemctl restart frank-default-large
 curl -sf http://127.0.0.1:7770/health