feat: auto-deploy tagged releases to CT 126 via signed webhook (0.3.1)

CI's new deploy job (tags only) sends the house HMAC webhook to CT 126; the
listener runs /usr/lib/devdesk/devdesk-deploy, which waits for the version in
the apt registry and upgrades devdesk with --force-confold. Running sessions
are untouched. Hook setup is documented in docs/DEPLOY.md.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.gitea/workflows/build-deb.yml

@@ -149,10 +149,32 @@ jobs:
             "$api/releases/$id/assets?name=$name" >/dev/null
           echo "release $TAG: $GITEA_URL/$REPO/releases/tag/$TAG"
 
+  deploy:
+    name: Deploy to CT 126
+    runs-on: ubuntu-latest
+    needs: [build]
+    if: startsWith(github.ref, 'refs/tags/v')
+    steps:
+      # CT 126's webhook listener runs /usr/lib/devdesk/devdesk-deploy, which
+      # waits for this version in the apt registry and upgrades the package.
+      - name: Trigger devdesk-deploy webhook
+        env:
+          WEBHOOK_SECRET: ${{ secrets.WEBHOOK_SECRET }}
+          GIT_REF: ${{ github.ref }}
+        run: |
+          PAYLOAD="{\"ref\":\"${GIT_REF}\"}"
+          SIG=$(echo -n "$PAYLOAD" | openssl dgst -sha256 -hmac "$WEBHOOK_SECRET" | awk '{print $2}')
+          curl -sf --connect-timeout 10 \
+            -X POST \
+            -H "Content-Type: application/json" \
+            -H "X-Gitea-Signature: ${SIG}" \
+            -d "$PAYLOAD" \
+            "http://10.10.10.58:9000/hooks/devdesk-deploy"
+
   notify-failure:
     name: Notify on failure
     runs-on: ubuntu-latest
-    needs: [build]
+    needs: [build, deploy]
     if: failure() && github.event_name == 'push'
     steps:
       - name: Send Matrix alert