fix(ci): Use deploy key instead of token for pushing

Deploy key is:
- Permanent (no expiration)
- Repo-scoped (no API access)
- SSH-based (more secure)

Setup: Add DEPLOY_KEY variable with base64-encoded SSH private key
Generate: ssh-keygen -t ed25519 -C 'ci@un-inception'
Encode: base64 -w0 < id_ed25519 | pbcopy

.gitlab-ci.yml

@@ -270,15 +270,23 @@ perf-report:
       echo "Step 3: Report contents..."
       ls -la "reports/$CI_COMMIT_TAG/" 2>/dev/null || echo "No report directory"
     - |
-      # Commit back to main (requires write access)
+      # Commit back to main (requires deploy key with write access)
       echo "Step 4: Committing to main..."
       if [ -d "reports/$CI_COMMIT_TAG" ]; then
+        # Setup SSH deploy key if available
+        if [ -n "$DEPLOY_KEY" ]; then
+          mkdir -p ~/.ssh
+          echo "$DEPLOY_KEY" | base64 -d > ~/.ssh/id_ed25519
+          chmod 600 ~/.ssh/id_ed25519
+          ssh-keyscan -H git.unturf.com >> ~/.ssh/known_hosts 2>/dev/null
+          git remote set-url origin "ssh://git@git.unturf.com:2222/${CI_PROJECT_PATH}.git"
+        fi
+
         git config user.email "ci@unturf.com"
         git config user.name "GitLab CI"
-        git remote set-url origin "https://gitlab-ci-token:${CI_JOB_TOKEN}@git.unturf.com/${CI_PROJECT_PATH}.git"
         git fetch origin main
         git checkout main
-        git pull origin main
+        git pull origin main --rebase
         git add reports/
         git diff --cached --quiet || {
           git commit -m "perf: Add performance report for $CI_COMMIT_TAG
@@ -286,7 +294,7 @@ perf-report:
 Generated automatically by CI after tagged release.
 Pipeline: $CI_PIPELINE_URL"
           git push origin main && echo "SUCCESS: Report committed to main" || \
-          echo "WARN: Push failed - CI_JOB_TOKEN may lack write access"
+          echo "WARN: Push failed - add DEPLOY_KEY variable (base64 encoded SSH private key)"
         }
       else
         echo "WARN: No report to commit"