Git on the server: a read-only key, and `.git` out of the web root

A deploy key that can only read, a repository that is not in the web root, and why git pull on the live site is not a switch.