make: add remote-seed-api-salt + show HEAD in remote-content-status

remote-seed-api-salt writes a per-host popularity salt into the env
override tree (user/env/<host>/config/plugins/api.yaml) so the api plugin
reads it there instead of appending one to the git-tracked
config/plugins/api.yaml. That appended salt kept the content working tree
perpetually dirty, which aborted git-sync's auto-merge on webhook and
silently broke prod auto-deploy. Salt is generated server-side, never
committed, and re-runs are idempotent.

remote-content-status now prints HEAD so a webhook auto-pull can be
verified.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Makefile

@@ -27,6 +27,7 @@ REMOTE_TARGETS := remote-env-setup remote-env-remove remote-wipe remote-install
 	remote-fetch remote-fetch-content remote-install-plugins remote-update-plugins \
 	remote-upgrade-grav remote-git-sync-disable remote-git-sync-enable \
 	remote-content-status remote-clean remote-diag remote-apply-env \
+	remote-seed-api-salt \
 	remote-gpm-install remote-maintenance-on remote-maintenance-off
 ENVS := test prod
 
@@ -173,7 +174,7 @@ remote-git-sync-enable: guard-env
 	$(SSH) "bash -s -- '$(WEBROOT)' true" < scripts/git-sync-toggle.sh
 
 remote-content-status: guard-env
-	$(SSH) "cd $(WEBROOT)/user && git status --short && echo '--- config diff ---' && git diff -- config/"
+	$(SSH) "cd $(WEBROOT)/user && echo '--- HEAD ---' && git log -1 --oneline && echo '--- working tree ---' && git status --short && echo '--- config diff ---' && git diff -- config/"
 
 remote-clean: guard-env
 	$(SSH) "cd $(WEBROOT) && php bin/grav clearcache"
@@ -197,6 +198,31 @@ remote-apply-env: guard-env
 	  $(SSH) "mkdir -p $(WEBROOT)/user/env/$$host/config && cat > $(WEBROOT)/user/env/$$host/config/system.yaml && cd $(WEBROOT) && php bin/grav clearcache" < deploy/env/$(ENV)/system.yaml; \
 	  echo "Applied deploy/env/$(ENV)/system.yaml -> $(WEBROOT)/user/env/$$host/config/system.yaml"
 
+# Seed a per-host popularity salt into the env override tree so the api plugin
+# reads it there instead of appending one to the git-tracked config/plugins/
+# api.yaml. That appended salt kept the content working tree dirty, which broke
+# git-sync's auto-merge on webhook. Salt is generated server-side and never
+# committed (a committed salt would be globally known). Idempotent: an existing
+# salt is kept, so re-running never rotates it.
+remote-seed-api-salt: guard-env
+	@host="$${WEB_HOST:-$(REMOTE_HOST)}"; \
+	  test -n "$$host" || { echo "ERROR: WEB_HOST/REMOTE_HOST unresolved"; exit 1; }; \
+	  $(SSH) "set -e; \
+	    envfile=$(WEBROOT)/user/env/$$host/config/plugins/api.yaml; \
+	    mkdir -p \$$(dirname \"\$$envfile\"); \
+	    if grep -qE '^[[:space:]]*salt:' \"\$$envfile\" 2>/dev/null; then \
+	      echo \"salt already present in \$$envfile — keeping it\"; \
+	    else \
+	      salt=\$$(openssl rand -hex 32); \
+	      printf 'popularity:\n  salt: %s\n' \"\$$salt\" > \"\$$envfile\"; \
+	      echo \"seeded new per-host salt into \$$envfile\"; \
+	    fi; \
+	    git -C $(WEBROOT)/user checkout -- config/plugins/api.yaml 2>/dev/null || true; \
+	    cd $(WEBROOT) && php bin/grav clearcache >/dev/null 2>&1 || true; \
+	    echo '--- base api.yaml status (expect clean) ---'; \
+	    git -C $(WEBROOT)/user status --short config/plugins/api.yaml; \
+	    echo '(if the line above is empty, the tree is clean)'"
+
 # Read-only health check: plugin install state, versions, key config, log tail.
 remote-diag: guard-env
 	$(SSH) "cd $(WEBROOT) && \