deploy: potentially fix self-deploy issue?

hosts/muffin/default.nix

@@ -26,6 +26,7 @@
     ../../modules/ntfy-alerts.nix
     ../../modules/server-power.nix
     ../../modules/server-deploy-guard.nix
+    ../../modules/server-deploy-finalize.nix
 
     ../../services/postgresql.nix
     ../../services/jellyfin
@@ -99,6 +100,13 @@
 
   services.deployGuard.enable = true;
 
+  # Detached deploy finalize: see modules/server-deploy-finalize.nix. deploy-rs
+  # activates in `boot` mode and invokes deploy-finalize to schedule the real
+  # `switch` (or reboot, when kernel/initrd/kernel-modules changed) 60s later
+  # as a pid1-owned transient unit. Prevents the self-hosted gitea runner from
+  # being restarted mid-CI-deploy.
+  services.deployFinalize.enable = true;
+
   # Disable serial getty on ttyS0 to prevent dmesg warnings
   systemd.services."serial-getty@ttyS0".enable = false;