Используя право мерзавца (для частного repo кода веб-сайта)?

No matter what you choose to do, you might want to automate it a bit using git hooks. Hooks are a set of scripts which git will execute on certain events. The relevant one here is the post-update hook (in the server's repository). In a normal repo, hooks are in .git/hooks, so in a bare repo they're in hooks. That directory probably currently contains a lot of example hook scripts (named *.sample in recent versions). You'll need to make one called post-update, containing whatever actions you want taken after the server is pushed to (e.g. cd to the other repo and execute the pull).

As for the specifics of your solution... you're doing the right thing by not pushing into a checked-out branch. The only possible issue with what you're doing is that the server ends up with an extra copy of the repository only used to check out the files. If you decide you don't like this waste of disk space, I'm pretty sure this would do what you want:

git --work-tree=/path/to/checkout-dir --bare reset --hard

This tells git to reset to the proper state, using the given path as the working directory, but keeping in mind that the repository is actually bare. I haven't personally done this kind of thing before, but it seems to work on my little test!

A note: if you decide you want to do push into a checked-out branch anyway (only if the repo on the server will never be used for anything but pushing to and checking out a copy of the files)... if you are totally sure about this, you can set receive.denyCurrentBranch to false in the server's gitconfig, execute git reset --hard on the server, forcing its working directory into the state it should be in.

Read "Why won't I see changes in the remote repo after "git push"?" in GitFaq (on Git Wiki).