Add self-update on startup via git pull

On each restart, CUE pulls the latest code from origin before
binding to the port, so deployments just require a service restart.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app.py

@@ -2,6 +2,7 @@ import hashlib
 import hmac
 import json
 import logging
+import subprocess
 import threading
 from flask import Flask, request, abort
 
@@ -91,6 +92,23 @@ def webhook():
     return {"status": "processing", "files": len(changed_files)}, 200
 
 
+def _self_update() -> None:
+    """Pull the latest code from origin before starting."""
+    try:
+        result = subprocess.run(
+            ["git", "pull", "--ff-only"],
+            capture_output=True,
+            text=True,
+        )
+        if result.returncode == 0:
+            logger.info("Self-update: %s", result.stdout.strip())
+        else:
+            logger.warning("Self-update failed: %s", result.stderr.strip())
+    except Exception as exc:
+        logger.warning("Self-update error: %s", exc)
+
+
 if __name__ == "__main__":
+    _self_update()
     logger.info("BLIGHT: CUE starting on port %d", config.WEBHOOK_PORT)
     app.run(host="0.0.0.0", port=config.WEBHOOK_PORT)