Git 2.3.0 added better support for "push to deploy" set-ups, using this option:
git config receive.denyCurrentBranch updateInstead
My question is: is it the server I'm pushing to, or the client I'm pushing from that needs git v2.3.0 to honour this option? Does the protocol used to access the pushed-to repository change this? (e.g. SSH vs. the git protocol)
The updateInstead setting for receive.denyCurrentBranch is implemented entirely on the server (receiving) side. Only the server needs to run 2.3.0. It doesn't matter what protocol you use.
You only need to set updateInstead on the server side (and probably shouldn't set it on the client side).