feat: DevDesk v0.1.0, a persistent browser terminal for Claude Code

ttyd serves a single-file xterm.js UI styled with the LotusGuild TDS
(web_template base.css). Sessions live in a dedicated tmux server unit
(devdesk-tmux.service), so restarting or upgrading the web unit never
stops Claude. Each named session maps to a project directory. A Claude
SessionStart hook records the conversation ID, so after a reboot the
session resumes that exact conversation.

- bin/devdesk: attach / new / ls / end / pick, with an fzf picker
- ttyd requires a credential that NPM injects; origin check enabled
- debian/: dh 13 with --no-stop-on-upgrade for the tmux unit, bundled
  sha256-verified ttyd 1.7.7, lintian overrides, man page
- CI: lint, test, build, smoke-test, artifact; v* tags publish to the
  Gitea apt registry and create a release

Refs: tinker ticket 887531976

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

scripts/fetch-ttyd.sh

@@ -0,0 +1,26 @@
+#!/bin/bash
+# Download the pinned upstream ttyd static binary and verify it against the
+# vendored SHA256SUMS. Usage: scripts/fetch-ttyd.sh OUTPUT [ARCH]
+set -euo pipefail
+
+out=${1:?usage: fetch-ttyd.sh OUTPUT [ARCH]}
+arch=${2:-x86_64}
+here=$(cd "$(dirname "$0")/.." && pwd)
+version=$(cat "$here/vendor/ttyd/VERSION")
+asset="ttyd.$arch"
+expected=$(awk -v a="$asset" '$2 == a { print $1 }' "$here/vendor/ttyd/SHA256SUMS")
+[ -n "$expected" ] || { echo "fetch-ttyd: no checksum for $asset" >&2; exit 1; }
+
+if [ -f "$out" ] && echo "$expected  $out" | sha256sum -c --status -; then
+    exit 0
+fi
+
+mkdir -p "$(dirname "$out")"
+tmp=$(mktemp "$out.XXXXXX")
+trap 'rm -f "$tmp"' EXIT
+curl -fsSL --retry 3 -o "$tmp" "https://github.com/tsl0922/ttyd/releases/download/$version/$asset"
+echo "$expected  $tmp" | sha256sum -c --status - || { echo "fetch-ttyd: checksum mismatch for $asset $version" >&2; exit 1; }
+chmod 0755 "$tmp"
+mv -f "$tmp" "$out"
+trap - EXIT
+echo "fetch-ttyd: $asset $version verified"