- bootstrap/app.php: validateCsrfTokens except webhook/* - WebhookController: ejecuta deploy-runner.sh (vive en repo) - deploy-runner.sh: hace git pull + composer + npm + migrate + cache - docker-compose.yml: solo monta el repo (sin script externo)