fix(ci): gate deploys on passing tags + fix markets feature flag test

- CI now creates v<pipeline_iid> tag after tests pass on master
- Supervisor fetches tags and only deploys when a newer tag is available;
  skips if already on latest or no tags exist
- Fix test_seeds_markets_enabled: markets is seeded disabled (enabled=0),
  test was asserting the wrong value

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/padelnomics/supervisor.py

@@ -17,12 +17,14 @@ Usage:
 """
 
 import importlib
+import json
 import logging
 import os
 import subprocess
 import sys
 import time
 import tomllib
+import urllib.request
 from collections import defaultdict
 from concurrent.futures import ThreadPoolExecutor, as_completed
 from datetime import UTC, datetime
@@ -44,6 +46,9 @@ SERVING_DUCKDB_PATH = os.getenv("SERVING_DUCKDB_PATH", "analytics.duckdb")
 ALERT_WEBHOOK_URL = os.getenv("ALERT_WEBHOOK_URL", "")
 NTFY_TOKEN = os.getenv("NTFY_TOKEN", "")
 WORKFLOWS_PATH = Path(os.getenv("WORKFLOWS_PATH", "infra/supervisor/workflows.toml"))
+GITLAB_API_URL = os.getenv("GITLAB_API_URL", "")       # e.g. https://gitlab.com
+GITLAB_PROJECT_ID = os.getenv("GITLAB_PROJECT_ID", "") # numeric or namespace/project
+GITLAB_TOKEN = os.getenv("GITLAB_TOKEN", "")           # read_api scope
 
 NAMED_SCHEDULES = {
     "hourly": "0 * * * *",
@@ -271,10 +276,47 @@ def web_code_changed() -> bool:
     return bool(result.stdout.strip())
 
 
+def current_deployed_tag() -> str | None:
+    """Return the tag currently checked out, or None if not on a tag."""
+    result = subprocess.run(
+        ["git", "describe", "--tags", "--exact-match", "HEAD"],
+        capture_output=True, text=True, timeout=10,
+    )
+    return result.stdout.strip() or None
+
+
+def latest_remote_tag() -> str | None:
+    """Fetch tags from origin and return the latest v<n> tag by version order."""
+    subprocess.run(
+        ["git", "fetch", "--tags", "--prune-tags", "origin"],
+        capture_output=True, text=True, timeout=30,
+    )
+    result = subprocess.run(
+        ["git", "tag", "--list", "--sort=-version:refname", "v*"],
+        capture_output=True, text=True, timeout=10,
+    )
+    tags = result.stdout.strip().splitlines()
+    return tags[0] if tags else None
+
+
 def git_pull_and_sync() -> None:
-    """Pull latest code and sync dependencies."""
-    run_shell("git fetch origin master")
-    run_shell("git switch --discard-changes --detach origin/master")
+    """Checkout the latest passing release tag and sync dependencies.
+
+    A tag v<N> is created by CI only after tests pass, so presence of a new
+    tag implies green CI. Skips if already on the latest tag.
+    """
+    latest = latest_remote_tag()
+    if not latest:
+        logger.info("No release tags found — skipping pull")
+        return
+
+    current = current_deployed_tag()
+    if current == latest:
+        logger.info("Already on latest tag %s — skipping pull", latest)
+        return
+
+    logger.info("New tag %s available (current: %s) — deploying", latest, current)
+    run_shell(f"git checkout --detach {latest}")
     run_shell("uv sync --all-packages")